High severity · published Oct 27, 2026
CVE-2026-117341
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log
New
7.7
CVSS
–
EPSS
No
On KEV
Description
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Octopus Server · Octopus Deploy
2019.0.0 before 2026.2.13438; 2026.3.0 before 2026.3.15829 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117341
advisories.octopus.com
https://advisories.octopus.com/post/2026/sa2026-16
More from Octopus Server
9.8
CVE-2022-2572
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still…
9.8
CVE-2022-2778
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes
9.1
CVE-2026-0704
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint
9.1
CVE-2022-2782
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters
8.7
CVE-2026-116870
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently