Octopus Server: Improper OIDC token issuer validation
Summary
In affected Octopus Server versions, OIDC token issuer validation is performed inconsistently. A token issued by a suitably configured, non-legitimate issuer can be accepted as a token of a service account that belongs to a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured, and the attacker must know or guess details of that identity. The vendor rates the issue High (CVSS 4.0: 8.7) and reports no known mitigation.
Affected
- Per vendor advisory SA2026-15: all 2024.x versions after 2024.1.11865, all 2025.x versions, all 2026.1 versions before 2026.1.11781, all 2026.2 versions before 2026.2.13438, all 2026.3 versions before 2026.3.15816.
- Per CNA record: 2024.1.0 to < 2026.1.11781; 2026.2.0 to < 2026.2.13438; 2026.3.0 to < 2026.3.15816.
- Octopus Cloud instances have already been patched.
Fixed in
- 2026.1.11781 or later (2026.1 branch)
- 2026.2.13438 or later (2026.2 branch)
- 2026.3.15816 or later (2026.3 branch)
- Vendor recommends the latest release, 2026.3.15973.
Workaround
- No known mitigation according to the vendor. Upgrading is the only remedy.
Exploitation
- The vendor is not aware of any public announcements or malicious use.
- The vulnerability was found during internal testing by Nathan Willoughby at Octopus Deploy.
- No public proof of concept was identified at the time of research.
Our recommendation
- Inventory all Octopus Server instances and confirm the installed build against the fixed versions.
- Upgrade to 2026.3.15973 or at least to the fixed build of your branch as soon as possible.
- Review service accounts that have OIDC identities configured and remove unused ones.
- Restrict network access to the Octopus Server web portal and API where possible.
- Monitor authentication logs for unexpected service account logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Octopus Deploy Security Advisory 2026-15 advisories.octopus.com
- OffSeq Radar: CVE-2026-116870 radar.offseq.com
- Strix: CVE-2026-116870 www.strix.ai
- VulDB entry 427120 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:01.
Original description (NVD)
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.