Octopus Server CVE-2026-4881

Exploitation requires a valid Octopus Server user credential at low privilege level (CVSS PR:L confirms this; unauthenticated attackers cannot exploit this flaw). The CVSS Attack Requirements value of AT:P (Present) indicates that some condition outside the attacker's direct control must hold - likely that the affected API endpoint is reachable on the network and the server is in a state where the action can be committed, which may not be true for all deployment configurations. Network access to the Octopus Server API is required (AV:N). No user interaction from a third party is needed (UI:N). Exploitation is limited by the authentication requirement and the AT:P precondition; the specific name or path of the affected API endpoint is not disclosed in public advisories, which adds an identification step for an attacker but does not constitute a meaningful security barrier once the server is accessible.

The CVSS 4.0 base score of 6.0 reflects a network-accessible (AV:N), low-complexity (AC:L) vulnerability requiring low-privilege authentication (PR:L) and some attack preconditions (AT:P), with no user interaction needed. The high availability impact (VA:H) suggests the server-level changes reachable through this endpoint can disrupt service operation. Real-world risk is moderate rather than critical: the requirement for a valid Octopus Server credential (PR:L) meaningfully limits the attacker pool to insiders, compromised accounts, or users who have legitimately obtained access. The AT:P condition introduces further uncertainty about universality of exploitation. No EPSS score was provided in source data, and the vulnerability is absent from the CISA KEV catalog, offering no signal of active exploitation in the wild. The 'Information Disclosure' tag conflicts with the VA:H-dominated CVSS vector, suggesting either the server's error response leaks operational detail or the tag reflects a secondary classification not fully captured in the CVSS. This discrepancy should be verified against the full vendor advisory. For organizations running Octopus Server with multiple users sharing access at varying trust levels - a common multi-team CI/CD deployment model - the insider-threat vector elevates practical risk beyond what the raw score implies.

An authenticated Octopus Server user with a standard low-privilege account - such as a developer with deployment-read access - sends a crafted request to the affected server-level API endpoint. The server applies the requested configuration change and then returns an error response, misleading the caller and potentially any audit log into treating the operation as failed. The attacker repeats or varies the request to degrade server availability or alter configuration, exploiting the gap between the visible error and the committed state change.