Octopus Server
79 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Octopus Server, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.
Octopus Server CVEs per month
| Month | CVEs |
|---|---|
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 5 |
| 2025-03 | 0 |
| 2025-04 | 1 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 2 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 2 |
| 2026-07 | 1 |
| 2026-08 | 1 |
| 2026-09 | 3 |
| 2026-10 | 3 |
Severity
How the 79 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical6
- High21
- Medium40
- Low4
Latest CVEs
The 15 most recently published vulnerabilities affecting Octopus Server.
- CVE-2026-102488In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted t...—
- CVE-2026-102478In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible...—
- CVE-2026-78210In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.—
- CVE-2026-101169In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization o...—
- CVE-2026-92355In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some co...—
- CVE-2026-91778In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission va...—
- CVE-2026-14163In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.7.5
- CVE-2026-12702In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.4.9
- CVE-2026-8296In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.—
- CVE-2026-4881In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite recei...6.5
- CVE-2026-3237In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint tha...4.3
- CVE-2026-3236In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mi...—
- CVE-2026-0704In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways ...9.1
- CVE-2025-0539In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to...8.8
- CVE-2025-0588In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user...4.9
Product grouping is registry-driven, with AI assist and human review. How it works