Octopus Deploy Octopus Server
73 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118426 | 3.0.0 – < 2026.2.13487 ; 2026.3.0 – < 2026.3.15909 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-12887 | 2023.0.0 – < 2026.1.674 ; 2026.1 – < 2026.1.674 ; 2026.2 – < 2026.2.973 ; … | In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the sc | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-117466 | 2019.0.0 – < 2026.2.13469 ; 2026.3.0 – < 2026.3.15863 | In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator. | HIGH 8.6 | 0.2 % | ||
| CVE-2026-117341 | 2019.0.0 – < 2026.2.13438 ; 2026.3.0 – < 2026.3.15829 | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is | HIGH 7.7 | 0.2 % | ||
| CVE-2026-116870 | 2024.1.0 – < 2026.1.11781 ; 2026.2.0 – < 2026.2.13438 ; 2026.3.0 – < 2026.3.15816 | In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from | HIGH 8.7 | 0.2 % | ||
| CVE-2026-102488 | 2019.5.0 – < 2026.2.12438 ; 2026.3.0 – < 2026.3.15816 | In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obta | HIGH 8.7 | 0.2 % | ||
| CVE-2026-102478 | 2023.2.945 – < 2026.1.11768 ; 2026.2.0 – < 2026.2.13408 ; 2026.3.0 – < 2026.3.15816 | In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access | HIGH 8.7 | 0.3 % | ||
| CVE-2026-78210 | 2019.5.9 – < 2026.1.11739 ; 2026.2.0 – < 2026.2.13364 ; 2026.3.0 – < 2026.3.13951 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101169 | 2019.4.1 – < 2026.1.11781 ; 2026.2.0 – < 2026.2.13441 ; 2026.3.0 – < 2026.3.15829 | In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafte | HIGH 8.7 | 0.3 % | ||
| CVE-2026-92355 | 2024.1.4131 – < 2026.1.11725 ; 2026.2.0 – < 2026.2.13344 ; 2026.3.0 – < 2026.3.11816 | In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to | HIGH 8.7 | 0.7 % | ||
| CVE-2026-91778 | 2019.0.0 – < 2026.1.11725 ; 2026.2.0 – < 2026.2.13344 ; 2026.3.0 – < 2026.3.11816 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the | HIGH 7.2 | 0.4 % | ||
| CVE-2026-14163 | 3.2.6 – < 2026.1.11587 ; 2026.2.61 – < 2026.2.13190 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment va | HIGH 7.1 | 0.4 % | ||
| CVE-2026-12702 | 2023.0.0 – < 2026.1.11587 ; 2026.1.0 – < 2026.1.11587 ; 2026.2.0 – < 2026.2.13190 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deploymen | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-8296 | 2023.0.0 – < 2025.4.10678 ; 2026.1.0 – < 2026.1.11451 ; 2026.2.0 – < 2026.2.13114 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts. | MEDIUM 5.6 | 0.3 % | ||
| CVE-2026-4881 | 2023.0.0 – < 2025.4.10523 ; 2025.4.0 – < 2025.4.10545 ; 2026.1.0 – < 2026.1.11313 | In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-3237 | 2023.0.0 – < 2025.3.14731 ; 2025.4.0 – < 2025.4.10359 ; 2026.1.0 – < 2026.1.5571 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expi | LOW 2.3 | 0.2 % | ||
| CVE-2026-3236 | 2023.0.0 – < 2025.3.14761 ; 2025.4.0 – < 2025.4.10409 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key ha | LOW 2.3 | 0.2 % | ||
| CVE-2026-0704 | 2023.0.0 – < 2025.3.14715 ; 2025.4.0 – < 2025.4.10359 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field | MEDIUM 5.9 | 0.4 % | ||
| CVE-2025-0539 | 2.6.0 – < 2024.3.13071 ; 2024.4.401 – < 2024.4.7065 | In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentic | MEDIUM 5.9 | 0.4 % | ||
| CVE-2025-0588 | 2020.1.0 – < 2024.3.13097 ; 2024.4.401 – < 2024.4.7091 | In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By s | MEDIUM 5.9 | 0.4 % | ||
| CVE-2025-0513 | 2024.3.164 – < 2024.3.12985 ; 2024.4.401 – < 2024.4.6962 | In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the | LOW 1.8 | 0.2 % | ||
| CVE-2025-0526 | 2022.4.791 – < 2024.3.13097 ; 2024.4.401 – < 2024.4.7091 | In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field | LOW 2.3 | 0.4 % | ||
| CVE-2025-0525 | 2020.6.4592 – < 2024.3.13007 ; 2024.4.401 – < 2024.4.6995 | In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could | LOW 2.3 | 0.4 % | ||
| CVE-2025-0589 | 2020.3.3 – < 2024.3.13071 ; 2024.4.401 – < 2024.4.7065 | In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated | MEDIUM 6.9 | 0.4 % | ||
| CVE-2024-1656 | 2018.1.0 – < 2024.2.9193 | Affected versions of Octopus Server had a weak content security policy. | LOW 2.6 | 0.2 % | ||
| CVE-2024-7998 | 2022.4.8332 – < 2024.1.12931 ; 2024.1.437 – < 2024.1.12931 ; 2024.2.101 – < 2024.2.9313 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifesp | LOW 2.6 | 0.2 % | ||
| CVE-2024-6972 | 2024.1 – < 2024.1.12759 ; 2024.2 – < 2024.2.9193 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in c | MEDIUM 6.5 | 0.2 % | ||
| CVE-2024-4811 | 2023.1 – < 2023.4.8608 ; 2024.1 – < 2024.1.12759 ; 2024.2 – < 2024.2.9193 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifac | LOW 2.2 | 0.2 % | ||
| CVE-2024-4456 | 3.0 – < 2023.3.13361 ; 2023.4.296 – < 2023.4.8338 ; 2024.1.437 – < 2024.1.11127 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page. | MEDIUM 5.4 | 0.3 % | ||
| CVE-2024-4226 | 2022.2.5205 – < 2022.2.7934 ; 2022.3.348 – < 2022.3.9163 | It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and p | LOW 3.5 | 0.3 % | ||
| CVE-2023-4509 | 2018.9 – < 2023.4.296 ; 2024.1 – < 2024.1.437 ; 2024.2 – < 2024.2.101 | It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt. | MEDIUM 4.3 | 0.2 % | ||
| CVE-2024-2975 | 0.9 – < 2023.4.8432 ; 2024.1.437 – < 2024.1.12087 ; 2024.2.101 – < 2024.2.2075 | A race condition was identified through which privilege escalation was possible in certain configurations. | HIGH 8.8 | 0.4 % | ||
| CVE-2023-1904 | 2022.2.7897 – < unspecified ; unspecified – < 2023.1.11942 ; unspecified – < 2023.2.13151 ; … | In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Oc | HIGH 7.5 | 0.4 % | ||
| CVE-2022-2416 | 2019.4.0 – < 2022.4.9997 ; 2023.1.0 – < 2023.1.10235 ; 2023.2.0 – < 2023.2.10545 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an | MEDIUM 5.5 | 0.3 % | ||
| CVE-2022-2346 | 2019.4.0 – < 2022.4.9997 ; 2023.1.0 – < 2023.1.10235 ; 2023.2.0 – < 2023.2.10545 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints. | MEDIUM 5.5 | 0.3 % | ||
| CVE-2022-4870 | 3.0 – < unspecified ; unspecified – < 2023.1.9879 | In affected versions of Octopus Deploy it is possible to discover network details via error message | MEDIUM 5.3 | 0.4 % | ||
| CVE-2023-2247 | 2018.3.0 – < unspecified ; unspecified – < 2022.3.10929 ; unspecified – < 2022.4.791 ; … | In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function | MEDIUM 5.3 | 0.4 % | ||
| CVE-2022-2507 | 0.9 – < unspecified ; 2022.3.348 – < unspecified ; unspecified – < 2022.3.10957 ; … | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage | MEDIUM 5.3 | 0.4 % | ||
| CVE-2022-4009 | 3.0.19 – < unspecified ; unspecified – < 2022.2.8552 ; 2022.3.348 – < unspecified ; … | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation | HIGH 8.8 | 0.7 % | ||
| CVE-2022-2259 | 2019.1.0 – < unspecified ; unspecified – < 2022.3.11098 ; 2022.4.791 – < unspecified ; … | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view t | MEDIUM 4.3 | 0.4 % | ||
| CVE-2022-2258 | 2019.1.0 – < unspecified ; unspecified – < 2022.3.11098 ; 2022.4.791 – < unspecified ; … | In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these | MEDIUM 4.3 | 0.5 % | ||
| CVE-2022-2883 | 0.9 – < unspecified ; unspecified – < 2022.3.11043 ; 2022.4.791 – < unspecified ; … | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service | HIGH 7.5 | 1.0 % | ||
| CVE-2022-4898 | 2019.7.0 – < unspecified ; unspecified – < 2022.2.8552 ; 2022.3.348 – < unspecified ; … | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. Thi | MEDIUM 5.4 | 0.4 % | ||
| CVE-2022-3614 | 3.5.1 – < unspecified ; unspecified – < 2022.2.8552 ; 2022.3.348 – < unspecified ; … | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication ch | MEDIUM 6.1 | 0.4 % | ||
| CVE-2022-3460 | 2018.3.1 – < unspecified ; unspecified – < 2021.3.13150 ; 2022.1.2121 – < unspecified ; … | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed | HIGH 7.5 | 0.6 % | ||
| CVE-2022-2721 | 2022.2.6729 – < unspecified ; unspecified – < 2022.2.7965 ; 2022.3.348 – < unspecified ; … | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plain | HIGH 7.5 | 0.6 % | ||
| CVE-2022-2572 | 3.5 – < unspecified ; unspecified – < 2022.1.3264 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys | CRITICAL 9.8 | 1.0 % | ||
| CVE-2022-2508 | 0.9 – < unspecified ; unspecified – < 2022.1.3264 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to | MEDIUM 5.3 | 0.6 % | ||
| CVE-2022-2782 | 0.9 – < unspecified ; unspecified – < 2022.2.8351 ; 2022.3.348 – < unspecified ; … | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session | CRITICAL 9.1 | 0.7 % | ||
| CVE-2022-2780 | 2021.2.994 – < unspecified ; unspecified – < 2022.1.3180 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB reques | HIGH 8.1 | 0.6 % | ||
| CVE-2022-2828 | 2022.1.2121 – < unspecified ; unspecified – < 2022.1.3135 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Referen | MEDIUM 6.5 | 0.7 % | ||
| CVE-2022-2720 | 3.16.4 – < unspecified ; unspecified – < 2022.1.3134 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value maskin | MEDIUM 5.3 | 0.6 % | ||
| CVE-2022-2783 | 3.12.0 – < unspecified ; unspecified – < 2022.1.3154 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token | MEDIUM 5.3 | 0.3 % | ||
| CVE-2022-2781 | 3.2.10 – < unspecified ; unspecified – < 2022.1.3154 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and v | MEDIUM 5.3 | 0.2 % | ||
| CVE-2022-2778 | 3.0 – < unspecified ; unspecified – < 2022.2.8277 ; 2022.3.348 – < unspecified ; … | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. | CRITICAL 9.8 | 0.9 % | ||
| CVE-2022-2760 | 2019.5.7 – < unspecified ; unspecified – < 2022.1.3180 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an erro | MEDIUM 4.3 | 0.5 % | ||
| CVE-2022-2528 | 3.0 – < unspecified ; unspecified – < 2022.1.3106 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing p | MEDIUM 6.5 | 0.5 % | ||
| CVE-2022-2075 | 0.9 – < unspecified ; unspecified – < 2022.1.2894 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validatio | HIGH 7.5 | 0.8 % | ||
| CVE-2022-2074 | 0.9 – < unspecified ; unspecified – < 2022.1.2894 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. | HIGH 7.5 | 0.9 % | ||
| CVE-2022-2049 | 0.9 – < unspecified ; unspecified – < 2022.1.2894 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. | HIGH 7.5 | 0.8 % | ||
| CVE-2022-1901 | 2019.7.3 – < unspecified ; unspecified – < 2022.1.3009 ; 2022.2.6729 – < unspecified ; … | In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview. | MEDIUM 5.3 | 0.5 % | ||
| CVE-2022-30532 | 0.9 – < unspecified ; unspecified – < 2021.3.13021 ; 2022.1.2121 – < unspecified ; … | In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy. | MEDIUM 5.3 | 0.5 % | ||
| CVE-2022-29890 | 2019.7.0 – < unspecified ; unspecified – < 2021.3.13021 ; 2022.1.2121 – < unspecified ; … | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. | MEDIUM 6.1 | 0.5 % | ||
| CVE-2022-1881 | 2021.1.1 – < unspecified ; unspecified – < 2021.3.13021 ; 2022.1.2121 – < unspecified ; … | In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download | MEDIUM 5.3 | 0.6 % | ||
| CVE-2022-2013 | 2022.1.1495 – < unspecified ; unspecified – < 2022.1.2647 | In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new | HIGH 7.5 | 0.9 % | ||
| CVE-2022-1670 | 0.9 – < unspecified ; unspecified – < 2021.3.12533 ; 2022.1.0 – < unspecified ; … | When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possib | HIGH 7.5 | 0.9 % | ||
| CVE-2022-1502 | < | Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users wi | MEDIUM 4.3 | 0.5 % | ||
| CVE-2022-23184 | unspecified – < 2021.2.8011 ; unspecified – < 2021.3.11057 | In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redi | MEDIUM 6.1 | 0.6 % | ||
| CVE-2021-26556 | 0.9 – < unspecified ; unspecified – < 2020.4.229 ; 2020.5.0 – < unspecified ; … | When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user us | HIGH 7.8 | 0.3 % | ||
| CVE-2021-31820 | 2018.8.2 – < unspecified ; unspecified – < 2020.6.5310 ; 2021.1.7149 – < unspecified ; … | In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in | HIGH 7.5 | 0.6 % | ||
| CVE-2021-31817 | 2020.6.4671 – < unspecified ; unspecified – < 2020.6.5146 ; 2021.1.7149 – < unspecified ; … | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written | HIGH 7.5 | 0.9 % | ||
| CVE-2021-31816 | 0.9 – < unspecified ; unspecified – < 2020.6.5146 ; 2021.1.7149 – < unspecified ; … | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written | HIGH 7.5 | 0.9 % | ||
| CVE-2021-31818 | 2018.9.17 – < unspecified ; unspecified – < 2020.6.5146 ; 2021.1.7149 – < unspecified ; … | Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied d | MEDIUM 4.3 | 0.6 % |