CVE-2026-102478
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible fo
Octopus Deploy Octopus Server
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2026.1.11768Octopus ServerCVE List
- 2026.2.13408Octopus ServerCVE List
- 2026.3.15816Octopus ServerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.
Text from CVE List
Affected versions 3
- Octopus Serveraffected: 2023.2.945 before 2026.1.11768CVE List
- Octopus Serveraffected: 2026.2.0 before 2026.2.13408CVE List
- Octopus Serveraffected: 2026.3.0 before 2026.3.15816CVE List