Vulnerability · Published Oct 7, 2026 · Assigned by Octopus
CVE-2026-102478
High 8.7
In plain English
A high-severity security flaw in Octopus Server from Octopus Deploy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Octopus Deploy | Octopus Server | 2023.2.945 – before 2026.1.117682026.2.0 – before 2026.2.134082026.3.0 – before 2026.3.15816 |
Weakness: CWE-1289 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N