Privilege Escalation Vulnerability in Octopus Server
CVE-2026-102478

8.7HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
7 October 2026

What is CVE-2026-102478?

In vulnerable versions of Octopus Server, authenticated users with role modification permissions can exploit improper input validation to gain unauthorized access. This risk enables attackers to weaken existing roles and elevate their privileges by adding themselves to privileged teams, leading to potential misuse of sensitive functionalities. It's essential for users to review their role configurations and promptly apply security updates to mitigate these risks.

Affected Version(s)

Octopus Server Windows 2023.2.945 < 2026.1.11768

Octopus Server Windows 2026.2.0 < 2026.2.13408

Octopus Server Windows 2026.3.0 < 2026.3.15816

References

https://advisories.octopus.com/post/2026/sa2026-11

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Nathan Willoughby
.