Octopus Server CVE-2026-3236

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUn

Server-level configuration changes can be made by any authenticated low-privilege user in Octopus Server through a speci

In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible t

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. Rated critical

In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive va

Path traversal in Octopus Deploy allows removing files and file contents on the host through API manipulation. Enables d

In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper valid

Path traversal in Octopus Server allows an authenticated low-privilege user to overwrite arbitrary files on the server f

Authenticated remote code execution in Octopus Server allows any user whose role grants permission to edit an Environmen

Privilege escalation in Octopus Server lets an authenticated user who already holds permission to modify roles weaken a

Incorrect authorization in Octopus Server causes the platform to evaluate multiple scoped permission assignments incorre