Octopus Server: Incorrect authorization of scoped permissions
Summary
Octopus Server incorrectly evaluates multiple scoped permission assignments. A highly privileged user can therefore obtain deployment permissions beyond those actually granted to them. The vendor rates the issue High (CVSS 8.7) and has not seen public exploitation. The attacker needs a valid account, so the main risk is misuse by insiders or through compromised credentials.
Affected
- Octopus Server 2019.5.0 up to before 2026.2.12438 (CVE record)
- Octopus Server 2026.2.x before 2026.2.13438 (vendor advisory)
- Octopus Server 2026.3.0 up to before 2026.3.15816
- Note: the vendor advisory and the CVE record differ on the fixed 2026.2 build (13438 vs. 12438). Verify on the vendor advisory page.
Fixed in
- Octopus Server 2026.2.13438 (vendor advisory; the CVE record lists 12438)
- Octopus Server 2026.3.15816
- Vendor recommends the latest release, 2026.3.15875.
Workaround
Unknown. The vendor states that there is no known mitigation and recommends upgrading.
- Interim measure (not vendor-stated): review the scoped permission assignments of highly privileged users and remove any that are not needed until the upgrade is complete.
Exploitation
- The vendor is not aware of any public announcements or malicious use.
- CISA SSVC data (Vulnrichment) lists exploitation as none and automatable as no.
- The CVE is not listed in the CISA KEV catalogue.
- No public proof of concept found.
Our recommendation
- Check the Octopus Server version now and upgrade to 2026.3.15816 or later on the 3.x branch, or to 2026.2.13438 on the 2.x branch.
- Review scoped roles and users with deployment rights and remove unneeded permissions.
- Check the other 2026 Octopus Server security advisories, as several scoped-permission flaws were reported this year.
- Monitor for unusual deployments or permission changes until the upgrade is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Octopus Security Advisory 2026-12 advisories.octopus.com
- NVD/CVE record via OpenCVE app.opencve.io
- Octopus Deploy advisories overview 2026 advisories.octopus.com
- CVE-2026-102488 via Strix www.strix.ai
- CISA ADP Vulnrichment data via HOL Guard hol.org
- Related: CVE-2026-91778 (NVD) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:22.
Original description (NVD)
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.