Insufficient Validation Vulnerability in Octopus Server by Octopus Deploy
CVE-2026-116835

8.7HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
12 November 2026

What is CVE-2026-116835?

In vulnerable versions of Octopus Server, a flaw exists in the validation of custom claims on OpenID Connect (OIDC) accounts. This security weakness permits a user with edit permissions to manipulate accounts, enabling the generation of signed OIDC tokens that can impersonate other projects. Successfully exploiting this vulnerability could permit unauthorized access to external systems, including cloud providers or alternate Octopus instances that trust the compromised project identity, potentially leading to severe security breaches.

Affected Version(s)

Octopus Server Windows 2025.3.11571 < 2026.2.13503

Octopus Server Windows 2026.3.0 < 2026.3.15894

References

https://advisories.octopus.com/post/2026/sa2026-22

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Terry Rossow
.