Advisories · Technology

Octopus Deploy Octopus Server.

Every CVE that names Octopus Deploy Octopus Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-118426 CVE record

CVSS 5.3 Medium

Missing authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-12887 CVE record

CVSS 5.1 Medium

Path traversal in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Path traversal
Not analysed yet 27 Oct 2026
CVE-2026-117466 CVE record

CVSS 8.6 High

Improper privilege management in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Privilege escalation
Not analysed yet 27 Oct 2026
CVE-2026-117341 CVE record

CVSS 7.7 High

Sensitive information in log files in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
Not analysed yet 27 Oct 2026
CVE-2026-116870 CVE record

CVSS 8.7 High

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently.
- Octopus Deploy Octopus Server
- CWE-1289
Not analysed yet 27 Oct 2026
CVE-2026-102488 CVE record

CVSS 8.7 High

Incorrect authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 8 Oct 2026
CVE-2026-102478 CVE record

CVSS 8.7 High

Octopus Deploy Octopus Server: In affected versions of Octopus Server…
- Octopus Deploy Octopus Server
- CWE-1289
Not analysed yet 7 Oct 2026
CVE-2026-78210 CVE record

CVSS 7.1 High

Incorrect authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 1 Oct 2026
CVE-2026-101169 CVE record

CVSS 8.7 High

Deserialization of untrusted data in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Insecure deserialization
Not analysed yet 29 Sept 2026
CVE-2026-92355 CVE record

CVSS 8.7 High

Path traversal in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Path traversal
Not analysed yet 16 Sept 2026
CVE-2026-91778 CVE record

CVSS 7.2 High

Incorrect authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 15 Sept 2026
CVE-2026-14163 CVE record

CVSS 7.1 High

Sensitive information in log files in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
Not analysed yet 20 Aug 2026
CVE-2026-12702 CVE record

CVSS 5.1 Medium

Improper access control in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 24 Jul 2026
CVE-2026-8296 CVE record

CVSS 5.6 Medium

Cross-site scripting in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Cross-site scripting (XSS)
Not analysed yet 19 Jun 2026
CVE-2026-4881 CVE record

CVSS 6.0 Medium

Missing authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 4 Jun 2026
CVE-2026-3237 CVE record

CVSS 2.3 Low

Improper authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 17 Mar 2026
CVE-2026-3236 CVE record

CVSS 2.3 Low

Incorrect authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 5 Mar 2026
CVE-2026-0704 CVE record

CVSS 5.9 Medium

Path traversal in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Path traversal
Not analysed yet 25 Feb 2026
CVE-2025-0539 CVE record

CVSS 5.9 Medium

Server-side request forgery in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Server-side request forgery (SSRF)
Not analysed yet 10 Apr 2025
CVE-2025-0588 CVE record

CVSS 5.9 Medium

HTTP response splitting in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Other injection
Not analysed yet 11 Feb 2025
CVE-2025-0513 CVE record

CVSS 1.8 Low

Cross-site scripting in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Cross-site scripting (XSS)
Not analysed yet 11 Feb 2025
CVE-2025-0526 CVE record

CVSS 2.3 Low

Missing authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 11 Feb 2025
CVE-2025-0525 CVE record

CVSS 2.3 Low

Information disclosure in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
Not analysed yet 11 Feb 2025
CVE-2025-0589 CVE record

CVSS 6.9 Medium

Octopus Deploy Octopus Server: In affected versions of Octopus Deploy where customers are using Active Directory for…
- Octopus Deploy Octopus Server
- CWE-648
Not analysed yet 11 Feb 2025
CVE-2024-1656 CVE record

CVSS 2.6 Low

Affected versions of Octopus Server had a weak content security policy.
- Octopus Deploy Octopus Server
Not analysed yet 11 Sept 2024
CVE-2024-7998 CVE record

CVSS 2.6 Low

Insufficient session expiration in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Authentication bypass
Not analysed yet 21 Aug 2024
CVE-2024-6972 CVE record

CVSS 6.5 Medium

Cleartext transmission of sensitive information in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Weak cryptography or TLS
Not analysed yet 25 Jul 2024
CVE-2024-4811 CVE record

CVSS 2.2 Low

Incorrect authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 25 Jul 2024
CVE-2024-4456 CVE record

CVSS 4.1 Medium

Cross-site scripting in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Cross-site scripting (XSS)
Not analysed yet 8 May 2024
CVE-2024-4226 CVE record

CVSS 3.5 Low

Incorrect default permissions in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 30 Apr 2024
CVE-2023-4509 CVE record

CVSS 4.3 Medium

Cleartext transmission of sensitive information in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Weak cryptography or TLS
Not analysed yet 17 Apr 2024
CVE-2024-2975 CVE record

CVSS 8.8 High

A race condition was identified through which privilege escalation was possible in certain configurations.
- Octopus Deploy Octopus Server
- CWE-1223
Not analysed yet 9 Apr 2024
CVE-2023-1904 CVE record

CVSS 4.2 Medium

Octopus Deploy Octopus Server: In affected versions of Octopus Server it is possible for the OpenID client secret to be…
- Octopus Deploy Octopus Server
Not analysed yet 14 Dec 2023
CVE-2022-2416 CVE record

CVSS 5.5 Medium

In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment.
- Octopus Deploy Octopus Server
Not analysed yet 2 Aug 2023
CVE-2022-2346 CVE record

CVSS 5.5 Medium

In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.
- Octopus Deploy Octopus Server
Not analysed yet 2 Aug 2023
CVE-2022-4870 CVE record

CVSS 5.3 Medium

Sensitive information in error messages in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
Not analysed yet 18 May 2023
CVE-2023-2247 CVE record

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function
- Octopus Deploy Octopus Server
Not analysed yet 2 May 2023
CVE-2022-2507 CVE record

CVSS 5.3 Medium

Cross-site scripting in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Cross-site scripting (XSS)
Not analysed yet 19 Apr 2023
CVE-2022-4009 CVE record

CVSS 8.8 High

Command injection in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Command injection
Not analysed yet 16 Mar 2023
CVE-2022-2259 CVE record

CVSS 4.3 Medium

Improper access control in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 13 Mar 2023
CVE-2022-2258 CVE record

CVSS 4.3 Medium

In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items
- Octopus Deploy Octopus Server
Not analysed yet 13 Mar 2023
CVE-2022-2883 CVE record

CVSS 7.5 High

Unrestricted file upload in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Unrestricted file upload
Not analysed yet 22 Feb 2023
CVE-2022-4898 CVE record

CVSS 5.4 Medium

Cross-site scripting in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Cross-site scripting (XSS)
Not analysed yet 31 Jan 2023
CVE-2022-3614 CVE record

CVSS 6.1 Medium

Authentication bypass in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Authentication bypass
Not analysed yet 3 Jan 2023
CVE-2022-3460 CVE record

CVSS 7.5 High

Information disclosure in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
Not analysed yet 2 Jan 2023
CVE-2022-2721 CVE record

CVSS 7.5 High

Sensitive information in log files in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
Not analysed yet 25 Nov 2022
CVE-2022-2572 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper authentication in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Authentication bypass
Not analysed yet 1 Nov 2022
CVE-2022-2508 CVE record

CVSS 5.3 Medium

Sensitive information in error messages in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
Not analysed yet 27 Oct 2022
CVE-2022-2782 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Insufficient session expiration in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Authentication bypass
Not analysed yet 26 Oct 2022
CVE-2022-2780 CVE record

CVSS 8.1 High

Authentication bypass by replay in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Authentication bypass
Not analysed yet 14 Oct 2022
CVE-2022-2828 CVE record

CVSS 6.5 Medium

Insecure direct object reference in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
Not analysed yet 13 Oct 2022
CVE-2022-2720 CVE record

CVSS 5.3 Medium

Exposure of personal information in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
Not analysed yet 12 Oct 2022
CVE-2022-2783 CVE record

Octopus Deploy Octopus Server: In affected versions of Octopus Server it was identified that a session cookie could be…
- Octopus Deploy Octopus Server
Not analysed yet 6 Oct 2022
CVE-2022-2781 CVE record

Octopus Deploy Octopus Server: In affected versions of Octopus Server it was identified that the same encryption process…
- Octopus Deploy Octopus Server
Not analysed yet 6 Oct 2022
CVE-2022-2778 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
- Octopus Deploy Octopus Server
Not analysed yet 30 Sept 2022
CVE-2022-2760 CVE record

CVSS 4.3 Medium

Sensitive information in error messages in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Information disclosure
Not analysed yet 28 Sept 2022
CVE-2022-2528 CVE record

In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.
- Octopus Deploy Octopus Server
Not analysed yet 9 Sept 2022
CVE-2022-2075 CVE record

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation.
- Octopus Deploy Octopus Server
Not analysed yet 19 Aug 2022
CVE-2022-2074 CVE record

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.
- Octopus Deploy Octopus Server
Not analysed yet 19 Aug 2022
CVE-2022-2049 CVE record

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.
- Octopus Deploy Octopus Server
Not analysed yet 19 Aug 2022