Octopus

Latest CVEs · RSS

• CVE-2026-102488 2026-10-08 · CVSS 8.7
  In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permis
• CVE-2026-102478 2026-10-07 · CVSS 8.7
  In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in
• CVE-2026-78210 2026-10-01 · CVSS 7.1
  In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the requi
• CVE-2026-101169 2026-09-29 · CVSS 8.7
  In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for t
• CVE-2026-92355 2026-09-16 · CVSS 8.7
  In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary
• CVE-2026-91778 2026-09-15 · CVSS 7.2
  In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server buil
• CVE-2026-12878 2026-08-25 · CVSS 8.6
  In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.
• CVE-2026-14163 2026-08-20 · CVSS 7.1
  In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in c
• CVE-2026-12702 2026-07-24 · CVSS 5.1
  In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.
• CVE-2026-8296 2026-06-19 · CVSS 5.6
  In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.
• CVE-2026-4881 2026-06-04 · CVSS 6.0
  In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using
• CVE-2026-3237 2026-03-17 · CVSS 2.3
  In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocatio
• CVE-2026-3236 2026-03-05 · CVSS 2.3
  In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exce
• CVE-2026-0704 2026-02-25 · CVSS 5.9
  In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation wh
• CVE-2025-0539 2025-04-10 · CVSS 5.9
  In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allow
• CVE-2025-0588 2025-02-11 · CVSS 5.9
  In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specific
• CVE-2025-0513 2025-02-11 · CVSS 1.8
  In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they
• CVE-2025-0526 2025-02-11 · CVSS 2.3
  In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation wh
• CVE-2025-0525 2025-02-11 · CVSS 2.3
  In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversary
• CVE-2025-0589 2025-02-11 · CVSS 6.9
  In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API
• CVE-2024-12226 2025-01-16 · CVSS 6.5
  In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was id
• CVE-2024-9194 2024-09-30 · CVSS 8.7
  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Lin
• CVE-2024-1656 2024-09-11 · CVSS 2.6
  Affected versions of Octopus Server had a weak content security policy.
• CVE-2024-7998 2024-08-21 · CVSS 2.6
  In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan.
• CVE-2024-6972 2024-07-25 · CVSS 6.5
  In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text.