Octopus Server: Privilege escalation via improper validation of unsafe equivalence
Summary
Octopus Server contains a flaw in input validation that allows an authenticated user with permission to modify roles to bypass access protections and escalate privileges. The attacker can weaken the built-in role and add their own account to a privileged team. Exploitation requires a valid account with role-modification permission.
Affected
- Octopus Server 2023.2.x after 2023.2.945 (vendor advisory lists all 2023.3.x to 2025.x as affected)
- Octopus Server 2026.1.x before 2026.1.11768
- Octopus Server 2026.2.x before 2026.2.13408
- Octopus Server 2026.3.x before 2026.3.15816
- Octopus Server 2026.4.x before 2026.4.1480 (Octopus Cloud only at the time of the fix)
Note: the CVE record lists the ranges 2023.2.945 to below 2026.1.11768, 2026.2.0 to below 2026.2.13408 and 2026.3.0 to below 2026.3.15816. The vendor advisory is the reference for the exact ranges.
Fixed in
- Octopus Server 2026.1.11768 or later
- Octopus Server 2026.2.13408 or later
- Octopus Server 2026.3.15816 or later
- The vendor recommends the latest version, 2026.3.15875
- Octopus Cloud instances have already been updated.
Workaround
Unknown. The vendor states there is no known mitigation and recommends upgrading as soon as possible.
Exploitation
- The vendor is not aware of any public announcements or malicious use.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No public proof of concept was found in a limited search.
Our recommendation
- Inventory all Octopus Server instances and their exact build numbers.
- Upgrade affected instances to the fixed builds or to the latest version, 2026.3.15875.
- Review changes to roles and teams, especially to built-in roles and privileged teams, for the period before patching.
- Restrict role-modification permissions to the smallest possible group of trusted administrators.
- Check whether the Octopus Server web interface is reachable from outside and restrict access where it is not required.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Octopus Deploy Security Advisory 2026-11 advisories.octopus.com
- OpenCVE: CVE-2026-102478 app.opencve.io
- VulDB: CVE-2026-102478 vuldb.com
- Vulners VulnCheck/CISA ADP record: CVE-2026-102478 vulners.com
- CISA ADP Vulnrichment record: CVE-2026-102478 hol.org
- OffSeq Radar: CVE-2026-102478 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:26.
Original description (NVD)
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.