Octopus Server: Privilege escalation via forged authentication cookies
Summary
In affected versions of Octopus Server, authentication cookies lack sufficient integrity protection. Combined with incorrect permission validation for users who can view users or audit events, an authenticated user can escalate their privileges to Administrator. If guest access is enabled, the vendor states that the attack can be run as the guest user, which raises the severity to Critical.
Affected
- Octopus Server 2022.x after 2022.1.3143
- Octopus Server 2023.x, 2024.x and 2025.x (all versions)
- Octopus Server 2026.x before 2026.2.13487
- Octopus Server 2026.3.x before 2026.3.15875
- Octopus Cloud instances have already been updated by the vendor.
Fixed in
- Octopus Server 2026.2.13487 or later (for 2026.2.x and 2026.1.x)
- Octopus Server 2026.3.15875 or later (for 2026.3.x)
- Vendor recommendation: latest version 2026.3.16030
Workaround
- Unknown. The vendor states there is no known mitigation and recommends upgrading as soon as possible.
Exploitation
- The vendor is not aware of any public announcements or malicious use.
- No CISA KEV entry, public proof of concept or vendor-reported in-the-wild exploitation was found in our research. This is not proof of absence.
Our recommendation
- Upgrade Octopus Server to 2026.3.16030, or at least to the fixed version for your branch (2026.2.13487 or 2026.3.15875).
- Review and disable guest access if it is not required.
- Review which accounts can view users or audit events and restrict these permissions.
- Review user accounts and audit logs for unexpected administrator changes.
- Check whether the server is reachable from outside the corporate network and restrict access if it is not needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor advisory SA2026-19 advisories.octopus.com
- Vendor advisory SA2026-17 (related fix) advisories.octopus.com
- Third-party product context securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:20.
Original description (NVD)
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.