OS
Product
Octopus Server
26
CVEs
0
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 4High 11Medium 11Low 0
Watch
Add Octopus Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4881 | 6.5 | Jun 4 | In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API… Affected: 2023.0.0 before 2025.4.10523; 2025.4.0 before 2025.4.10545; 2026.1.0 before 2026.1.11313 |
| CVE-2022-2828 | 6.5 | Oct 13 | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability Affected: 2022.1.2121 before unspecified; before 2022.1.3135; 2022.2.6729 before unspecified; before 2022.2.7897; 2022.3.348 before unspecified; before 2022.3.10586 |
| CVE-2026-8296 | 5.6 | Jun 19 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts Affected: 2023.0.0 before 2025.4.10678; 2026.1.0 before 2026.1.11451; 2026.2.0 before 2026.2.13114 |
| CVE-2022-2508 | 5.3 | Oct 27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging Affected: 0.9 before unspecified; before 2022.1.3264; 2022.2.6729 before unspecified; before 2022.2.8351; 2022.3.348 before unspecified; before 2022.3.10586; +2 more |
| CVE-2022-2720 | 5.3 | Oct 12 | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work Affected: 3.16.4 before unspecified; before 2022.1.3134; 2022.2.6729 before unspecified; before 2022.2.7934; 2022.3.348 before unspecified; before 2022.3.10586 |
| CVE-2022-2783 | 5.3 | Oct 6 | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token Affected: 3.12.0 before unspecified; before 2022.1.3154; 2022.2.6729 before unspecified; before 2022.2.7897; 2022.3.348 before unspecified; before 2022.3.10586 |
| CVE-2022-2781 | 5.3 | Oct 6 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables Affected: 3.2.10 before unspecified; before 2022.1.3154; 2022.2.6729 before unspecified; before 2022.2.7897; 2022.3.348 before unspecified; before 2022.3.10586 |
| CVE-2026-12887 New | 5.1 | Oct 27 | In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent… Affected: 2023.0.0 before 2026.1.674; 2026.1 before 2026.1.674; 2026.2 before 2026.2.973; 2026.3 before 2026.3.5839 |
| CVE-2026-12702 | 4.9 | Jul 24 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment Affected: 2023.0.0 before 2026.1.11587; 2026.1.0 before 2026.1.11587; 2026.2.0 before 2026.2.13190 |
| CVE-2026-3237 | 4.3 | Mar 17 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via… Affected: 2023.0.0 before 2025.3.14731; 2025.4.0 before 2025.4.10359; 2026.1.0 before 2026.1.5571 |
| CVE-2026-3236 | 4.3 | Mar 5 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original… Affected: 2023.0.0 before 2025.3.14761; 2025.4.0 before 2025.4.10409 |
Showing 11