EUVD-2026-38000
GHSA-vwwv-2j8q-wf75
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges and active victim interaction required; scope unchanged with confidentiality-only impact matching session theft via stored XSS.
Primary rating from Vendor (Octopus).
CVSS VectorVendor: Octopus
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.
AnalysisAI
Stored Cross-Site Scripting in Octopus Server allows authenticated high-privilege users to embed malicious JavaScript payloads through the artifact upload mechanism, which execute in the browsers of other users who interact with the affected artifact. The CVSS 4.0 vector (PR:H, UI:A, VC:H) confirms exploitation requires elevated access and victim interaction, with the primary impact being confidentiality - likely session token or credential theft. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a high-privilege account on Octopus Server with permission to create or upload artifacts (PR:H per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.6 (Medium) accurately reflects a vulnerability with meaningful confidentiality impact but layered prerequisites that substantially reduce exploitability in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or legitimately holds a high-privilege Octopus Server account (e.g., a deployment engineer or compromised service account) uploads an artifact to a deployment or runbook containing a crafted filename or embedded content with an XSS payload. When a target user - such as an operations engineer or security reviewer - views the deployment summary or artifact listing in their browser, the payload executes and exfiltrates their session cookie to an attacker-controlled endpoint, enabling session hijacking without requiring the attacker to know the victim's credentials. |
| Remediation | Consult the Octopus Deploy vendor advisory at https://advisories.octopus.com/post/2026/sa2026-05 for the confirmed patched release version - no specific fix version number was included in the available intelligence data so none is cited here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Octopus Server
View allIn Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUn
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible t
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. Rated critical
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive va
Path traversal in Octopus Deploy allows removing files and file contents on the host through API manipulation. Enables d
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper valid
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsof
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to in
When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an
A race condition was identified through which privilege escalation was possible in certain configurations. Rated high se
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today