Octopus Server CVE-2026-118426

Exploitation requires two conditions both drawn from the description: (1) the Octopus Server instance must have the LDAP authentication provider enabled, and (2) the attacker must already be an authenticated user (CVSS PR:L), so this is not reachable by anonymous/unauthenticated actors. On instances using a different authentication provider or with LDAP disabled, the affected LDAP user-search and group-search functions are not applicable. No user interaction is required and the vector is network-reachable, but the authenticated-plus-LDAP-enabled requirement meaningfully limits the exposed population.

This is a moderate-severity information-disclosure/authorization flaw (CWE-862, Missing Authorization), not a critical issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and is internally consistent with the description: PR:L reflects that the actor is already an authenticated Octopus Server user, VC:L reflects limited confidentiality exposure (LDAP directory data returned via user/group search), and VI/VA:N reflect no integrity or availability impact. There is no CISA KEV listing and no EPSS score was supplied, so there is no signal of active or probable widespread exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The only reference is the vendor's own advisory (sa2026-18), reported by Octopus, with a vuln.today Decision label of 'this_month' - consistent with a real-but-non-emergency patch priority rather than an act-now situation. The practical risk is bounded: an attacker must already hold valid credentials AND the LDAP authentication provider must be enabled. Where those hold, a low-privileged authenticated user can enumerate LDAP directory contents (users/groups) they were not authorized to query, which is useful for reconnaissance and lateral-movement planning but does not by itself grant code execution or privilege escalation.

A low-privileged but authenticated Octopus Server user on an instance configured with the LDAP authentication provider invokes the LDAP user-search and LDAP group-search functions, which fail to enforce an authorization check. They harvest directory information (account names, group memberships) for reconnaissance to support further targeting. No public exploit code has been identified; only the vendor advisory is available.