Octopus Server: Incorrect authorization in project trigger permission validation
Summary
Octopus Server does not correctly validate permissions for users who create project triggers. An authenticated user with low privileges and trigger creation rights can run runbooks or create deployments they are not authorised to perform. Exploitation requires a valid account on the server, and the advisory describes the impact on integrity as high.
Affected
- Octopus Server 2019.11.0 up to before 2026.2.13487
- Octopus Server 2026.3.0 up to before 2026.3.15863
- Per vendor upgrade guidance, 2026.1.x is also affected and must move to 2026.2.13487 or later (not listed in the CVE record)
- Octopus Cloud instances have already been updated by the vendor
Fixed in
- Octopus Server 2026.2.13487 (for 2026.1.x and 2026.2.x)
- Octopus Server 2026.3.15863 (for 2026.3.x)
- Latest release recommended by the vendor: 2026.3.16030
Workaround
Unknown. The vendor states there is no known mitigation and recommends upgrading as soon as possible.
Exploitation
- The vendor is not aware of public announcements or malicious use.
- The vulnerability was found during internal testing by Nathan Willoughby at Octopus Deploy.
- Public proof of concept: unknown (not verified).
- Not listed in CISA KEV at the time of research.
Our recommendation
- Inventory all Octopus Server instances and their exact versions, including 2026.1.x.
- Upgrade to 2026.2.13487 or 2026.3.15863 at minimum; the vendor recommends 2026.3.16030.
- Until patched, restrict who can create or edit project triggers and review existing triggers.
- Keep the web interface and API off the internet and limit access to admin networks.
- Review audit logs for trigger creation and for runbook or deployment runs by users who should not have them.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Octopus Security Advisory 2026-20 advisories.octopus.com
- OpenCVE: CVE-2026-93487 app.opencve.io
- ThreatInt: CVE-2026-93487 record cve.threatint.com
- Octopus Security Advisory 2026-06 (project triggers) advisories.octopus.com
- Octopus documentation: Deployment target triggers octopus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:24.
Original description (NVD)
In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.