Octopus Deploy Security Advisories
Home
Advisories icon
2021 2022 2023 2024 2025 2026
Severity Levels
Disclosure Policy

  • Security Advisory 2026-24

    Nov 12, 2026 · Vulnerability/Incorrect Authorization Severity/high CVSS/8.7

    Disabled LDAP self-service identity editing can be bypassed (CVE-2026-124628)

    Read More

  • Security Advisory 2026-23

    Nov 12, 2026 · Vulnerability/Incorrect Authorization Severity/high CVSS/8.7

    LDAP identity injection during invitation (CVE-2026-124627)

    Read More

  • Security Advisory 2026-22

    Nov 12, 2026 · Vulnerability/Improperly Controlled Modification of Dynamically-Determined Object Attributes Severity/high CVSS/8.7

    Custom OIDC claims allow subject spoofing and cross-project impersonation (CVE-2026-116835)

    Read More

  • Security Advisory 2026-21

    Nov 11, 2026 · Vulnerability/Incorrect Authorization Severity/high CVSS/7.7

    Privilege escalation via LDAP login editing (CVE-2026-105948)

    Read More

  • Security Advisory 2026-20

    Nov 9, 2026 · Vulnerability/Incorrect Authorization Severity/high CVSS/7.1

    Incorrect Project Trigger Permission Validation (CVE-2026-93487)

    Read More

  • Security Advisory 2026-19

    Nov 9, 2026 · Vulnerability/Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking Severity/high CVSS/8.7

    Authentication Cookie Forgery Leading to Privilege Escalation (CVE-2026-96414)

    Read More

  • Security Advisory 2026-18

    Oct 28, 2026 · Vulnerability/Missing Authorization Severity/medium CVSS/5.3

    LDAP directory enumeration (CVE-2026-118426)

    Read More

  • Security Advisory 2026-17

    Oct 27, 2026 · Vulnerability/Improper Privilege Management Severity/high CVSS/8.6

    Privilege escalation from System Manager to Administrator (CVE-2026-117466)

    Read More

  • Security Advisory 2026-16

    Oct 27, 2026 · Vulnerability/Insertion of Sensitive Information into Log File Severity/high CVSS/7.7

    Invitation codes written to audit event log (CVE-2026-117341)

    Read More

  • Security Advisory 2026-15

    Oct 27, 2026 · Vulnerability/Improper Validation of Unsafe Equivalence in Input Severity/high CVSS/8.7

    OIDC Issuer Confusion (CVE-2026-116870)

    Read More
    • ««
    • «
    • 1
    • 2
    • 3
    • 4
    • 5
    • »
    • »»

Recent Security Advisories

  • Security Advisory 2026-24
  • Security Advisory 2026-23
  • Security Advisory 2026-22
  • Security Advisory 2026-21
  • Security Advisory 2026-20
  • Security Advisory 2026-19
  • Security Advisory 2026-18
  • Security Advisory 2026-17

Products

OCTOPUS SERVER 84 OCTOPUS TENTACLE 4 OCTOPUS DEPLOY TEAMCITY PLUGIN 3 OCTOPUS JAVA SDK 3 HALIBUT 1 KUBERNETES WORKER AND AGENT 1

Tags

SEVERITY/MEDIUM 42 SEVERITY/HIGH 28 SEVERITY/LOW 25 CVSS/8.7 10 VULNERABILITY/INCORRECT AUTHORIZATION 9 VULNERABILITY/INFORMATION EXPOSURE 7 VULNERABILITY/BROKEN ACCESS CONTROL 6 VULNERABILITY/VULNERABLE-DEPENDENCY 6 CVSS/6.5 5 VULNERABILITY/CLEAR-TEXT-STORAGE-OF-SENSITIVE-VALUE 5 VULNERABILITY/STORED XSS 5 CVSS/2.3 4 CVSS/5.9 4 CVSS/7.1 4
All Tags
CVSS/1.81 CVSS/2.22 CVSS/2.34 CVSS/2.41 CVSS/2.51 CVSS/2.62 CVSS/3.01 CVSS/3.12 CVSS/3.41 CVSS/3.52 CVSS/3.61 CVSS/3.81 CVSS/3.91 CVSS/4.12 CVSS/4.21 CVSS/4.32 CVSS/4.91 CVSS/5.12 CVSS/5.32 CVSS/5.41 CVSS/5.53 CVSS/5.61 CVSS/5.73 CVSS/5.94 CVSS/6.01 CVSS/6.32 CVSS/6.43 CVSS/6.55 CVSS/6.83 CVSS/6.91 CVSS/7.14 CVSS/7.21 CVSS/7.31 CVSS/7.72 CVSS/8.01 CVSS/8.61 CVSS/8.710 CVSS/8.81 CVSS/9.91 SEVERITY/CRITICAL1 SEVERITY/HIGH28 SEVERITY/LOW25 SEVERITY/MEDIUM42 VULNERABILITY/ABNORMAL INVITE CODE FUNCTIONALITY1 VULNERABILITY/AUTHENTICATION BYPASS BY CAPTURE-REPLAY1 VULNERABILITY/AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL1 VULNERABILITY/BROKEN ACCESS CONTROL6 VULNERABILITY/CLEAR-TEXT-STORAGE-OF-SENSITIVE-VALUE5 VULNERABILITY/CROSS-SITE SCRIPTING (XSS)1 VULNERABILITY/CSRF1 VULNERABILITY/DENIAL OF SERVICE3 VULNERABILITY/DESERIALIZATION OF UNTRUSTED DATA.1 VULNERABILITY/DOTNET VULNERABILITY1 VULNERABILITY/ENCRYPTION1 VULNERABILITY/EXPOSURE OF SENSITIVE INFORMATION THROUGH ENVIRONMENTAL VARIABLES1 VULNERABILITY/IMPROPER NEUTRALISATION OF SPECIAL ELEMENTS USED IN A COMMAND1 VULNERABILITY/IMPROPER PRIVILEGE MANAGEMENT1 VULNERABILITY/IMPROPER RESTRICTION OF RENDERED UI LAYERS OR FRAMES1 VULNERABILITY/IMPROPER VALIDATION OF UNSAFE EQUIVALENCE IN INPUT2 VULNERABILITY/IMPROPERLY CONTROLLED MODIFICATION OF DYNAMICALLY-DETERMINED OBJECT ATTRIBUTES1 VULNERABILITY/INCORRECT AUTHORISATION2 VULNERABILITY/INCORRECT AUTHORIZATION9 VULNERABILITY/INCORRECT PRIVILEGE ASSIGNMENT3 VULNERABILITY/INFORMATION DISCLOSURE3 VULNERABILITY/INFORMATION EXPOSURE7 VULNERABILITY/INSECURE DIRECT OBJECT REFERENCE (IDOR)1 VULNERABILITY/INSERTION OF SENSITIVE INFORMATION INTO LOG FILE2 VULNERABILITY/INSUFFICIENT SESSION EXPIRATION2 VULNERABILITY/LOCAL-PRIVILEGE-ESCALATION3 VULNERABILITY/LOGGING1 VULNERABILITY/MISSING AUTHORIZATION1 VULNERABILITY/OBSERVABLE DISCREPANCY1 VULNERABILITY/OPEN-REDIRECT1 VULNERABILITY/PATH TRAVERSAL4 VULNERABILITY/PRIVILEGE-ESCALATION1 VULNERABILITY/RATE LIMIT BYPASS1 VULNERABILITY/REGEX DENIAL OF SERVICE3 VULNERABILITY/RELIANCE ON OBFUSCATION OR ENCRYPTION OF SECURITY-RELEVANT INPUTS WITHOUT INTEGRITY CHECKING1 VULNERABILITY/REMOTE-CODE-EXECUTION3 VULNERABILITY/SENSITIVE VARIABLE EXPOSURE1 VULNERABILITY/SERVER-SIDE REQUEST FORGERY2 VULNERABILITY/SERVER-SIDE REQUEST FORGERY (SSRF)1 VULNERABILITY/SQL-INJECTION2 VULNERABILITY/STORED XSS5 VULNERABILITY/VARIABLE SECRET EXPOSURE1 VULNERABILITY/VULNERABLE-DEPENDENCY6
[A~Z][0~9]
Octopus Deploy Security Advisories

Copyright   OCTOPUS DEPLOY SECURITY ADVISORIES. All Rights Reserved