Local Privilege Escalation Vulnerability in Octopus Server by Octopus Deploy

CVE-2021-26556

What is CVE-2021-26556?

A local privilege escalation vulnerability exists in Octopus Server when it is installed in a custom folder location. This flaw arises due to incorrect folder ACLs, which may allow an unprivileged user to exploit DLL side-loading techniques to gain elevated privileges. Organizations utilizing custom installations of Octopus Server should review their configurations and apply mitigations to ensure they are not susceptible to this security issue.

References