Security feed

25 October 2026

advisoryOfficial CVE List25 Oct 2026

CVE-2026-102488

In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.

Octopus Server CVE-2026-102488

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102488

Octopus Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102488
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #12445 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:07:55 GMT
Publisher date: Thu, 08 Oct 2026 01:38:57 GMT

Read the original announcement

advisoryOfficial CVE List25 Oct 2026

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.

Octopus Server CVE-2026-102478

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102478

Octopus Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102478
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #12149 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:02:44 GMT
Publisher date: Wed, 07 Oct 2026 01:17:54 GMT

Read the original announcement

24 October 2026

advisoryOfficial CVE List24 Oct 2026

CVE-2026-78210

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.

Octopus Server CVE-2026-78210

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-78210

Octopus Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-78210
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #5666 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:12:38 GMT
Publisher date: Thu, 01 Oct 2026 04:36:23 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-101169

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.

Octopus Server CVE-2026-101169

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-101169

Octopus Server

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-101169
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #3830 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:41:11 GMT
Publisher date: Tue, 29 Sep 2026 07:49:29 GMT

Read the original announcement