Medium
Security advisory
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-21270
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 11:32 UTC · Revision 1
Source evidence
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.
osv:CVE-2021-21270
Complete source record
{
"id": "2f62c709bea4a084cd8699299b0776e3f1971395eb89ad79080338e876ea1073",
"url": "https://osv.dev/vulnerability/CVE-2021-21270",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-21270",
"summary": "OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.",
"evidence": "osv:CVE-2021-21270",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-21270",
"aliases": [
"CVE-2021-21270",
"GHSA-phmm-rfg9-94fm"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/octopusdeploy/octopusdsc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "24b448e6ac964ed938475add494a145c0473ac42"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:octopus:octopusdsc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.0.1002"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "24b448e6ac964ed938475add494a145c0473ac42"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "24b448e6ac964ed938475add494a145c0473ac42"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v4.0.1002"
}
]
}
}
],
"versions": [
"v4.0.977",
"v4.0.957",
"v4.0.934",
"v4.0.932",
"v4.0.834",
"v4.0.929",
"v4.0.924",
"v4.0.917",
"v4.0.903",
"v4.0.900",
"v4.0.897",
"v4.0.896",
"v4.0.891",
"v4.0.889",
"v4.0.884",
"v4.0.883",
"v4.0.881",
"v4.0.880",
"v4.0.876",
"v4.0.872",
"v4.0.843",
"v4.0.837",
"v4.0.831",
"v4.0.829",
"v4.0.816",
"v4.0.810",
"v4.0.807",
"v4.0.805",
"v4.0.801",
"v4.0.800",
"v4.0.782",
"v4.0.776",
"v4.0.770",
"v4.0.769",
"v4.0.762",
"v4.0.752",
"v4.0.746",
"v4.0.745",
"v4.0.743",
"v4.0.733",
"v4.0.732",
"v4.0.713",
"v4.0.693",
"v4.0.689",
"v4.0.659",
"v4.0.640",
"v4.0.639",
"v4.0.629",
"v4.0.626",
"v4.0.625",
"v4.0.623",
"v4.0.620",
"v4.0.618",
"v4.0.588",
"v4.0.587",
"v4.0.583",
"v4.0.579",
"v4.0.553",
"v4.0.538",
"v4.0.537",
"v4.0.522",
"v4.0.449",
"v4.0.447",
"v4.0.433",
"v4.0.432",
"v4.0.425",
"v4.0.423",
"v4.0.419",
"v4.0.416",
"v4.0.408",
"v4.0.403",
"v4.0.401",
"v4.0.394",
"v4.0.384",
"v4.0.382",
"v4.0.376",
"v4.0.368",
"v4.0.365",
"v4.0.362",
"v4.0.360",
"v4.0.358",
"v4.0.357",
"v4.0.347",
"v4.0.327",
"v4.0.303",
"v4.0.284",
"v4.0.258",
"v4.0.253",
"v4.0.250",
"v4.0.249",
"v4.0.247",
"v4.0.244",
"v4.0.242",
"v4.0.235",
"v4.0.227",
"v4.0.226",
"v4.0.220",
"v4.0.217",
"v4.0.208",
"v4.0.205",
"v4.0.198",
"v4.0.194",
"v4.0.190",
"v3.0.187",
"v3.0.169",
"v3.0.168",
"v3.0.167",
"v3.0.153",
"v3.0.150",
"v3.0.149",
"v3.0.148",
"v3.0.147",
"v3.0.146",
"v3.0.142",
"v3.0.141",
"v3.0.140",
"v3.0.105",
"v3.0.98",
"v3.0.94",
"v3.0.92",
"v3.0.84",
"v3.0.81",
"v3.0.78",
"v3.0.74",
"v3.0.72",
"v3.0.70",
"v3.0.65",
"v3.0.62",
"v3.0.45",
"v3.0.39",
"v3.0.28",
"v3.0.27",
"v3.0.17",
"v3.0.7",
"v3.0.6",
"v3.0.4",
"v3.0.2",
"v3.0.1",
"v2.0.136",
"v2.0.123",
"v2.0.120",
"v2.0.118",
"v2.0.106",
"v2.0.104",
"v2.0.103"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21270.json"
}
}
],
"modified": "2026-10-20T10:54:28.296685480Z",
"provider": "osv",
"references": [
"https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002",
"https://github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fm",
"https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42",
"https://github.com/OctopusDeploy/OctopusDSC/pull/270"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-21270",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 385415,
"published_at": "2021-01-22T18:15:12.687+00:00"
}