LDAP Authentication Flaw in Octopus Server by Octopus Deploy
CVE-2026-124627

8.7HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
12 November 2026

What is CVE-2026-124627?

In specific versions of Octopus Server, a security flaw exists due to improper validation of external identities during user registration. When LDAP authentication is enabled, a new user may inadvertently inherit LDAP-mapped team memberships and permissions of another user. This misconfiguration poses risks for environments using LDAP groups mapped to Octopus teams, potentially leading to unauthorized access to sensitive resources.

Affected Version(s)

Octopus Server Windows 3.0.0 < 2026.2.13526

Octopus Server Windows 2026.3.0 < 2026.3.15926

References

https://advisories.octopus.com/post/2026/sa2026-23

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Nathan Willoughby
.