What is CVE-2026-3237?

CVE-2026-3237 is a medium-severity vulnerability in Octopus Server, classified under Improper Authorization. CVSS score: 4.3/10. Published 2026-03-17.

How severe is CVE-2026-3237?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Octopus Server

CVE-2026-3237

In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.

Published 2026-03-17 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.003 (15.3th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 15.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001

Affected products

Octopus Server
Octopus Deploy Server — versions 2023.0.0, 2025.4.0, 2026.1.0

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

advisories.octopus.com/post/2026/sa2026-03 (Vendor Advisory)

Frequently asked questions

What is CVE-2026-3237?: CVE-2026-3237 is a medium-severity vulnerability in Octopus Server, classified under Improper Authorization. CVSS score: 4.3/10. Published 2026-03-17.
How severe is CVE-2026-3237?: Medium severity. CVSS v3 base score is 4.3 out of 10.