Octopus Deploy vulnerabilities
We track 24 vulnerabilities in Octopus Deploy products. 24 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest Octopus Deploy vulnerabilities
- 8.7 High severity
Octopus Server: Incorrect Authorization
In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membe
- 8.7 High severity
Octopus Server: Incorrect Authorization
In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects ins
- 8.7 High severity
Octopus Server: Improperly Controlled Modification of Dynamically-Determined Object Attributes
In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access
- 7.1 High severity
Octopus Server: Incorrect Authorization
In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.
- 7.7 High severity
Octopus Server: Incorrect Authorization
In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator acces
- 8.7 High severity
Octopus Server: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their
- 7.7 High severity
Octopus Server: Insertion of Sensitive Information into Log File
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successf
- 8.7 High severity
Octopus Server: Improper Validation of Unsafe Equivalence in Input
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate t
- 8.7 High severity
Octopus Server: Incorrect Authorization
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.
- 8.7 High severity
Octopus Server: Improper Validation of Unsafe Equivalence in Input
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's accoun
- 7.1 High severity
Octopus Server: Incorrect Authorization
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.
- 8.7 High severity
Octopus Server: Deserialization of Untrusted Data
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the
- 8.7 High severity
Octopus Server: Improper Limitation of a Pathname to a Restricted Directory
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution.
- 7.2 High severity
Octopus Server: Incorrect Authorization
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission validation during script execution would allow the script to exec
- 7.5 High severity
Octopus Server: Insertion of Sensitive Information into Log File
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.
- 9.1 Critical severity
Octopus Server: Improper Limitation of a Pathname to a Restricted Directory
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.
- 8.8 High severity
Octopus Server: Server-Side Request Forgery
In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially
- 7.5 High severity
Octopus Server: Exposure of Sensitive Information to an Unauthorized Actor
In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversary with information that may aid in further attacks against the server.
- 7.5 High severity
Octopus Server: Insertion of Sensitive Information into Log File
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.
- 7.5 High severity
Octopus Server: Improper Removal of Sensitive Information Before Storage or Transfer
In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.
- 7.5 High severity
Octopus Server: Insertion of Sensitive Information into Log File
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled.
- 9.8 Critical severity
Octopus Server: Improper Authentication
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.
- 9.1 Critical severity
In affected versions of Octopus Server it is possible for a session token to be valid…
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.
- 8.1 High severity
Octopus Server: Authentication Bypass by Capture-replay
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.