Vulnerability in Octopus Server - LDAP Authentication Risk
CVE-2026-118426

5.3MEDIUM

Key Information:

Vendor: Octopus Deploy
Status: Octopus Server
Vendor: CVE Published:; 29 October 2026

🔔 Create Octopus Deploy Vulnerability Alert

What is CVE-2026-118426?

A vulnerability in Octopus Server with the LDAP authentication provider enabled allows any authenticated user to execute unauthorized LDAP user searches and group searches. This can lead to exposure of sensitive group and user information, potentially compromising the integrity of the system and its data.

Affected Version(s)

Octopus Server Windows 3.0.0 < 2026.2.13487

Octopus Server Windows 2026.3.0 < 2026.3.15909

References

https://advisories.octopus.com/post/2026/sa2026-18

CVSS V4

Score:

5.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 29, 2026
Vulnerability Reserved
Oct 28, 2026

Credit

This vulnerability was found by Nathan Willoughby

CVE-2026-118426 Data

JSON