Sensitive Variable Exposure in Octopus Server by Octopus Deploy
CVE-2026-14163

7.1HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
20 August 2026

What is CVE-2026-14163?

Certain versions of Octopus Server have a vulnerability that permits sensitive variables to be displayed in the deployment variable snapshot as clear-text. This exposure could allow unauthorized users to access critical information, potentially leading to severe security risks. Mitigating this vulnerability involves promptly updating to the latest version where this issue has been addressed.

Affected Version(s)

Octopus Server Windows 3.2.6 < 2026.1.11587

Octopus Server Windows 2026.2.61 < 2026.2.13190

References

https://advisories.octopus.com/post/2026/sa2026-07/

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Octopus Deploy Customer
.