Octopus Deploy vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-117466 In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.High 8.6 · Oct 27, 2026
• CVE-2026-117341 In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log.High 7.7 · Oct 27, 2026
• CVE-2026-116870 In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently.High 8.7 · Oct 27, 2026
• CVE-2026-102488 In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permisHigh 8.7 · Oct 7, 2026
• CVE-2026-102478 In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in High 8.7 · Oct 6, 2026
• CVE-2026-78210 In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the requiHigh 7.1 · Oct 1, 2026
• CVE-2026-101169 In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for tHigh 8.7 · Sep 29, 2026
• CVE-2026-92355 In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary High 8.7 · Sep 16, 2026
• CVE-2026-91778 In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server builHigh 7.2 · Sep 15, 2026
• CVE-2026-12878 In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.High 8.6 · Aug 25, 2026
• CVE-2026-14163 In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in cHigh 7.1 · Aug 20, 2026
• CVE-2024-2975 A race condition was identified through which privilege escalation was possible in certain configurations.High 8.8 · Apr 8, 2024
• CVE-2022-4009 In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creationHigh 8.8 · Mar 16, 2023
• CVE-2022-2883 In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of ServiceHigh 7.5 · Feb 21, 2023
• CVE-2022-3460 In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.High 7.5 · Jan 2, 2023
• CVE-2022-2721 In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verboHigh 7.5 · Nov 25, 2022
• CVE-2022-2572 In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deletCritical 9.8 · Oct 31, 2022
• CVE-2022-2782 In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters.Critical 9.1 · Oct 27, 2022
• CVE-2022-2780 In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the pHigh 8.1 · Oct 14, 2022
• CVE-2022-2778 In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.Critical 9.8 · Sep 30, 2022
• CVE-2022-2075 In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation.High 7.5 · Aug 19, 2022
• CVE-2022-2074 In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.High 7.5 · Aug 19, 2022
• CVE-2022-2049 In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.High 7.5 · Aug 19, 2022
• CVE-2022-2013 In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have accHigh 7.5 · Jun 12, 2022
• CVE-2022-1670 When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users.High 7.5 · May 19, 2022