API Key Management Vulnerability in Octopus Server by Octopus Deploy
CVE-2026-3236

2.3LOW

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
5 March 2026

What is CVE-2026-3236?

In certain versions of Octopus Server, a significant vulnerability was discovered where an existing access token could be used to generate a new API key. This resulted in the new API key retaining a lifetime that exceeded that of the original key, effectively allowing unauthorized access and potential exploitation of services relying on this API key structure. Users and administrators are highly encouraged to review their systems and implement recommended security measures to mitigate risks associated with this vulnerability.

Affected Version(s)

Octopus Server Windows 2023.0.0 < 2025.3.14761

Octopus Server Windows 2025.4.0 < 2025.4.10409

References

https://advisories.octopus.com/post/2026/sa2026-02

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by nguyennb
.