Authorization Flaw in Octopus Server by Octopus Deploy
CVE-2026-93487

7.1HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
11 November 2026

What is CVE-2026-93487?

A vulnerability exists in Octopus Server that stems from improper validation of user permissions. This flaw may enable a user with insufficient access rights to create project triggers, resulting in unauthorized execution of runbooks and deployments. Such weaknesses can lead to significant security breaches, as they allow malicious actors to manipulate project workflows undetected. It is crucial for all users to ensure they are running an updated version of the Octopus Server to mitigate this risk.

Affected Version(s)

Octopus Server Windows 2019.11.0 < 2026.2.13487

Octopus Server Windows 2026.3.0 < 2026.3.15863

References

https://advisories.octopus.com/post/2026/sa2026-20

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Nathan Willoughby
.