EUVD-2026-38000
GHSA-vwwv-2j8q-wf75
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges and active victim interaction required; scope unchanged with confidentiality-only impact matching session theft via stored XSS.
Primary rating from Vendor (Octopus).
CVSS VectorVendor: Octopus
Lifecycle Timeline
2DescriptionCVE.org
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.
AnalysisAI
Stored Cross-Site Scripting in Octopus Server allows authenticated high-privilege users to embed malicious JavaScript payloads through the artifact upload mechanism, which execute in the browsers of other users who interact with the affected artifact. The CVSS 4.0 vector (PR:H, UI:A, VC:H) confirms exploitation requires elevated access and victim interaction, with the primary impact being confidentiality - likely session token or credential theft. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Technical ContextAI
Octopus Server, developed by Octopus Deploy, is a CI/CD deployment automation platform. Artifacts in Octopus Server are files (logs, outputs, configuration snapshots) attached to deployments or runbook runs and surfaced in the web UI. The affected code path fails to sanitize attacker-controlled content when rendering artifact metadata or content within the web interface, producing a classic stored XSS condition. Although the CWE is listed as N/A in the advisory data, the behavior maps to CWE-79 (Improper Neutralization of Input During Web Page Generation). The CPE cpe:2.3:a:octopus_deploy:octopus_server:*:*:*:*:*:*:*:* covers all versions of the server-side application; no bounded version range was published in the available data.
RemediationAI
Consult the Octopus Deploy vendor advisory at https://advisories.octopus.com/post/2026/sa2026-05 for the confirmed patched release version - no specific fix version number was included in the available intelligence data so none is cited here. As a compensating control while patching, restrict artifact upload and management permissions to the minimum set of trusted accounts, reducing the pool of principals who can introduce malicious payloads; note this may limit deployment workflow visibility for some team members. Additionally, Content Security Policy (CSP) headers, if not already enforced by the Octopus Server web interface, can significantly reduce the impact of any stored XSS by blocking inline script execution and unauthorized data exfiltration endpoints. Monitor artifact activity logs for unexpected file names or content patterns as a detection measure.
More in Octopus Server
View allIn Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUn
Server-level configuration changes can be made by any authenticated low-privilege user in Octopus Server through a speci
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible t
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. Rated critical
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive va
Path traversal in Octopus Deploy allows removing files and file contents on the host through API manipulation. Enables d
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper valid
Path traversal in Octopus Server allows an authenticated low-privilege user to overwrite arbitrary files on the server f
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsof
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to in
When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today