Privilege Escalation Vulnerability in Octopus Server by Octopus Deploy
CVE-2026-117341

7.7HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117341?

In certain versions of Octopus Server, an issue exists where the user invitation code is logged in the audit event log. If this invitation is linked to a space, a user with the necessary permissions may access the invitation code in the log. Exploiting this vulnerability can allow attackers to redeem unclaimed invitations, leading to unwanted privilege escalation contingent upon the permissions associated with the invited user.

Affected Version(s)

Octopus Server Windows 2019.0.0 < 2026.2.13438

Octopus Server Windows 2026.3.0 < 2026.3.15829

References

https://advisories.octopus.com/post/2026/sa2026-16

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Nathan Willoughby
.