# cve.now: Octopus Deploy

The newest entries naming Octopus Deploy as an affected vendor (up to 200), of 80 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118426](https://cve.now/CVE-2026-118426.md): In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user… (CVSS 5.3)
- [CVE-2026-12887](https://cve.now/CVE-2026-12887.md): In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the… (CVSS 5.1)
- [CVE-2026-117466](https://cve.now/CVE-2026-117466.md): In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator. (CVSS 8.6)
- [CVE-2026-117341](https://cve.now/CVE-2026-117341.md): In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. (CVSS 7.7)
- [CVE-2026-116870](https://cve.now/CVE-2026-116870.md): In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. (CVSS 8.7)
- [CVE-2026-102488](https://cve.now/CVE-2026-102488.md): In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obta (CVSS 8.7)
- [CVE-2026-102478](https://cve.now/CVE-2026-102478.md): In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access (CVSS 8.7)
- [CVE-2026-78210](https://cve.now/CVE-2026-78210.md): In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without (CVSS 7.1)
- [CVE-2026-101169](https://cve.now/CVE-2026-101169.md): In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafte (CVSS 8.7)
- [CVE-2026-92355](https://cve.now/CVE-2026-92355.md): In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to (CVSS 8.7)
- [CVE-2026-91778](https://cve.now/CVE-2026-91778.md): In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the (CVSS 7.2)
- [CVE-2026-12878](https://cve.now/CVE-2026-12878.md): In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions. (CVSS 8.6)
- [CVE-2026-14163](https://cve.now/CVE-2026-14163.md): In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment va (CVSS 7.1)
- [CVE-2026-12702](https://cve.now/CVE-2026-12702.md): In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deploymen (CVSS 5.1)
- [CVE-2026-8296](https://cve.now/CVE-2026-8296.md): In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts. (CVSS 5.6)
- [CVE-2026-4881](https://cve.now/CVE-2026-4881.md): In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server (CVSS 6.0)
- [CVE-2026-3237](https://cve.now/CVE-2026-3237.md): In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expi (CVSS 2.3)
- [CVE-2026-3236](https://cve.now/CVE-2026-3236.md): In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key ha (CVSS 2.3)
- [CVE-2026-0704](https://cve.now/CVE-2026-0704.md): In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. (CVSS 5.9)
- [CVE-2025-0539](https://cve.now/CVE-2025-0539.md): In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentic (CVSS 5.9)
- [CVE-2025-0588](https://cve.now/CVE-2025-0588.md): In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. (CVSS 5.9)
- [CVE-2025-0513](https://cve.now/CVE-2025-0513.md): In affected versions of Octopus Server error messages were handled unsafely on the error page. (CVSS 1.8)
- [CVE-2025-0526](https://cve.now/CVE-2025-0526.md): In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. (CVSS 2.3)
- [CVE-2025-0525](https://cve.now/CVE-2025-0525.md): In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. (CVSS 2.3)
- [CVE-2025-0589](https://cve.now/CVE-2025-0589.md): In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated (CVSS 6.9)
- [CVE-2024-12226](https://cve.now/CVE-2024-12226.md): In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in cle (CVSS 6.5)
- [CVE-2024-1656](https://cve.now/CVE-2024-1656.md): Affected versions of Octopus Server had a weak content security policy. (CVSS 2.6)
- [CVE-2024-7998](https://cve.now/CVE-2024-7998.md): In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifesp (CVSS 2.6)
- [CVE-2024-6972](https://cve.now/CVE-2024-6972.md): In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in c (CVSS 6.5)
- [CVE-2024-4811](https://cve.now/CVE-2024-4811.md): In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifac (CVSS 2.2)
- [CVE-2024-4456](https://cve.now/CVE-2024-4456.md): In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page. (CVSS 4.1)
- [CVE-2024-4226](https://cve.now/CVE-2024-4226.md): It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and p (CVSS 3.5)
- [CVE-2023-4509](https://cve.now/CVE-2023-4509.md): It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt. (CVSS 4.3)
- [CVE-2024-2975](https://cve.now/CVE-2024-2975.md): A race condition was identified through which privilege escalation was possible in certain configurations. (CVSS 8.8)
- [CVE-2023-1904](https://cve.now/CVE-2023-1904.md): In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Oc (CVSS 4.2)
- [CVE-2022-2416](https://cve.now/CVE-2022-2416.md): In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an (CVSS 5.5)
- [CVE-2022-2346](https://cve.now/CVE-2022-2346.md): In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints. (CVSS 5.5)
- [CVE-2022-4870](https://cve.now/CVE-2022-4870.md): In affected versions of Octopus Deploy it is possible to discover network details via error message (CVSS 5.3)
- [CVE-2022-4008](https://cve.now/CVE-2022-4008.md): In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service (CVSS 5.5)
- [CVE-2023-2247](https://cve.now/CVE-2023-2247.md): In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function (no CVSS)
- [CVE-2022-2507](https://cve.now/CVE-2022-2507.md): In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage (CVSS 5.3)
- [CVE-2022-4009](https://cve.now/CVE-2022-4009.md): In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation (CVSS 8.8)
- [CVE-2022-2259](https://cve.now/CVE-2022-2259.md): In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view t (CVSS 4.3)
- [CVE-2022-2258](https://cve.now/CVE-2022-2258.md): In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these (CVSS 4.3)
- [CVE-2022-2883](https://cve.now/CVE-2022-2883.md): In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service (CVSS 7.5)
- [CVE-2022-4898](https://cve.now/CVE-2022-4898.md): In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. (CVSS 5.4)
- [CVE-2022-3614](https://cve.now/CVE-2022-3614.md): In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication ch (CVSS 6.1)
- [CVE-2022-3460](https://cve.now/CVE-2022-3460.md): In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed (CVSS 7.5)
- [CVE-2022-2721](https://cve.now/CVE-2022-2721.md): In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plain (CVSS 7.5)
- [CVE-2022-2572](https://cve.now/CVE-2022-2572.md): In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys (CVSS 9.8)
- [CVE-2022-2508](https://cve.now/CVE-2022-2508.md): In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to (CVSS 5.3)
- [CVE-2022-2782](https://cve.now/CVE-2022-2782.md): In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session (CVSS 9.1)
- [CVE-2022-2780](https://cve.now/CVE-2022-2780.md): In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB reques (CVSS 8.1)
- [CVE-2022-2828](https://cve.now/CVE-2022-2828.md): In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Referen (CVSS 6.5)
- [CVE-2022-2720](https://cve.now/CVE-2022-2720.md): In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value maskin (CVSS 5.3)
- [CVE-2022-2783](https://cve.now/CVE-2022-2783.md): In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token (no CVSS)
- [CVE-2022-2781](https://cve.now/CVE-2022-2781.md): In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and v (no CVSS)
- [CVE-2022-2778](https://cve.now/CVE-2022-2778.md): In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. (CVSS 9.8)
- [CVE-2022-2760](https://cve.now/CVE-2022-2760.md): In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an erro (CVSS 4.3)
- [CVE-2022-2528](https://cve.now/CVE-2022-2528.md): In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing p (no CVSS)
- [CVE-2022-2075](https://cve.now/CVE-2022-2075.md): In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validatio (no CVSS)
- [CVE-2022-2074](https://cve.now/CVE-2022-2074.md): In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. (no CVSS)
- [CVE-2022-2049](https://cve.now/CVE-2022-2049.md): In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. (no CVSS)
- [CVE-2022-1901](https://cve.now/CVE-2022-1901.md): In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview. (no CVSS)
- [CVE-2022-30532](https://cve.now/CVE-2022-30532.md): In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy. (no CVSS)
- [CVE-2022-29890](https://cve.now/CVE-2022-29890.md): In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. (no CVSS)
- [CVE-2022-1881](https://cve.now/CVE-2022-1881.md): In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download (no CVSS)
- [CVE-2022-2013](https://cve.now/CVE-2022-2013.md): In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new (no CVSS)
- [CVE-2022-1670](https://cve.now/CVE-2022-1670.md): When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. (no CVSS)
- [CVE-2022-1502](https://cve.now/CVE-2022-1502.md): Permissions were not properly verified in the API on projects using version control in Git. (no CVSS)
- [CVE-2022-23184](https://cve.now/CVE-2022-23184.md): In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redi (no CVSS)
- [CVE-2021-31821](https://cve.now/CVE-2021-31821.md): When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Se (no CVSS)
- [CVE-2021-31822](https://cve.now/CVE-2021-31822.md): When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. (no CVSS)
- [CVE-2021-26557](https://cve.now/CVE-2021-26557.md): When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user (no CVSS)
- [CVE-2021-26556](https://cve.now/CVE-2021-26556.md): When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user us (no CVSS)
- [CVE-2021-31819](https://cve.now/CVE-2021-31819.md): In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already t (no CVSS)
- [CVE-2021-31820](https://cve.now/CVE-2021-31820.md): In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in (no CVSS)
- [CVE-2021-31817](https://cve.now/CVE-2021-31817.md): When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written (no CVSS)
- [CVE-2021-31816](https://cve.now/CVE-2021-31816.md): When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written (no CVSS)
- [CVE-2021-31818](https://cve.now/CVE-2021-31818.md): Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied d (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/octopus-deploy
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.