Improper Permission Management in Octopus Server by Octopus Deploy
CVE-2026-102488

8.7HIGH

Key Information:

Vendor: Octopus Deploy
Status: Octopus Server
Vendor: CVE Published:; 8 October 2026

🔔 Create Octopus Deploy Vulnerability Alert

What is CVE-2026-102488?

In the impacted versions of Octopus Server, a flaw exists in the evaluation of scoped permission assignments. This vulnerability allows users with elevated privileges to gain deployment permissions that exceed what they are legitimately granted. This misconfiguration can lead to unauthorized access to deployment functionalities, potentially compromising system security.

Affected Version(s)

Octopus Server Windows 2019.5.0 < 2026.2.12438

Octopus Server Windows 2026.3.0 < 2026.3.15816

References

https://advisories.octopus.com/post/2026/sa2026-12

CVSS V4

Score:

8.7

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 8, 2026
Vulnerability Reserved
Sep 29, 2026

Credit

This vulnerability was found by Nathan Willoughby

CVE-2026-102488 Data

JSON