OIDC Token Validation Flaw in Octopus Server by Octopus Deploy
CVE-2026-116870

8.7HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116870?

In certain versions of Octopus Server, there exists an inconsistency in the validation of OIDC tokens issued by different issuers. This vulnerability could allow tokens from improperly configured non-legitimate issuers to be accepted as authentic tokens from trusted service accounts. Successful exploitation requires that a service account has at least one OIDC identity set up, and that the attacker has knowledge or can guess certain identifiers associated with that identity, enabling potential unauthorized access.

Affected Version(s)

Octopus Server Windows 2024.1.0 < 2026.1.11781

Octopus Server Windows 2026.2.0 < 2026.2.13438

Octopus Server Windows 2026.3.0 < 2026.3.15816

References

https://advisories.octopus.com/post/2026/sa2026-15

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Nathan Willoughby
.