CVE-2026-4881 | Medium | 6.5 | 2026-06-04 | In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes usin… |
CVE-2026-3237 | Medium | 4.3 | 2026-03-17 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocati… |
CVE-2026-3236 | Medium | 4.3 | 2026-03-05 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exc… |
CVE-2026-0704 | Critical | 9.1 | 2026-02-25 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation w… |
CVE-2025-0539 | High | 8.8 | 2025-04-10 | In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allo… |
CVE-2025-0588 | Medium | 4.9 | 2025-02-11 | In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifi… |
CVE-2025-0526 | Medium | 5.4 | 2025-02-11 | In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation w… |
CVE-2025-0513 | Medium | 5.4 | 2025-02-11 | In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they… |
CVE-2025-0525 | High | 7.5 | 2025-02-11 | In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversar… |
CVE-2025-0589 | Medium | 5.3 | 2025-02-11 | In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API… |
CVE-2024-9194 | Critical | 9.8 | 2024-09-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Li… |
CVE-2024-1656 | Low | 2.6 | 2024-09-11 | Affected versions of Octopus Server had a weak content security policy. |
CVE-2024-7998 | Low | 2.6 | 2024-08-21 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan. |
CVE-2024-6972 | Medium | 6.5 | 2024-07-25 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text. |
CVE-2024-4811 | Low | 2.2 | 2024-07-25 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts. |
CVE-2024-4456 | Medium | 4.1 | 2024-05-08 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page. |
CVE-2024-4226 | Low | 3.5 | 2024-04-30 | It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This fu… |
CVE-2023-4509 | Medium | 4.3 | 2024-04-18 | It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt. |
CVE-2024-2975 | High | 8.8 | 2024-04-09 | A race condition was identified through which privilege escalation was possible in certain configurations. |
CVE-2023-1904 | Medium | 4.2 | 2023-12-14 | In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server. |
CVE-2022-2416 | Medium | 5.5 | 2023-08-02 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment. |
CVE-2022-2346 | Medium | 5.5 | 2023-08-02 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints. |
CVE-2022-4870 | Medium | 5.3 | 2023-05-18 | In affected versions of Octopus Deploy it is possible to discover network details via error message |
CVE-2022-4008 | Medium | 5.5 | 2023-05-10 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
CVE-2023-2247 | Medium | 5.3 | 2023-05-02 | In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function |
CVE-2022-2507 | Medium | 5.3 | 2023-04-19 | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage |
CVE-2022-4009 | High | 8.8 | 2023-03-16 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation |
CVE-2022-2259 | Medium | 4.3 | 2023-03-13 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items |
CVE-2022-2258 | Medium | 4.3 | 2023-03-13 | In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items |
CVE-2022-2883 | High | 7.5 | 2023-02-22 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
CVE-2022-4898 | Medium | 5.4 | 2023-01-31 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially res… |
CVE-2022-3614 | Medium | 6.1 | 2023-01-03 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirec… |
CVE-2022-3460 | High | 7.5 | 2023-01-03 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. |
CVE-2022-2721 | High | 7.5 | 2022-11-25 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verb… |
CVE-2022-2572 | Critical | 9.8 | 2022-11-01 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/dele… |
CVE-2022-2782 | Critical | 9.1 | 2022-10-27 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. |
CVE-2022-2508 | Medium | 5.3 | 2022-10-27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose erro… |
CVE-2022-2780 | High | 8.1 | 2022-10-14 | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the… |
CVE-2022-2828 | Medium | 6.5 | 2022-10-13 | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerabi… |
CVE-2022-2720 | Medium | 5.3 | 2022-10-12 | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partial… |
CVE-2022-2783 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token |
CVE-2022-2781 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables. |
CVE-2022-2778 | Critical | 9.8 | 2022-09-30 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. |
CVE-2022-2760 | Medium | 4.3 | 2022-09-28 | In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a re… |
CVE-2022-2528 | Medium | 6.5 | 2022-09-09 | In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages. |
CVE-2022-2075 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation. |
CVE-2022-2074 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. |
CVE-2022-2049 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. |
CVE-2022-1901 | Medium | 5.3 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview. |
CVE-2022-30532 | Medium | 5.3 | 2022-07-19 | In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy. |
CVE-2022-29890 | Medium | 6.1 | 2022-07-15 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. |
CVE-2022-1881 | Medium | 5.3 | 2022-07-15 | In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports fro… |
CVE-2022-2013 | High | 7.5 | 2022-06-13 | In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have ac… |
CVE-2022-1670 | High | 7.5 | 2022-05-19 | When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this r… |
CVE-2022-1502 | Medium | 4.3 | 2022-05-04 | Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView… |
CVE-2022-23184 | Medium | 6.1 | 2022-02-07 | In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects. |
CVE-2021-31821 | Medium | 5.5 | 2022-01-19 | When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in pla… |
CVE-2021-31822 | High | 7.8 | 2021-11-24 | When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged… |
CVE-2021-26557 | High | 7.8 | 2021-10-07 | When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-load… |
CVE-2021-26556 | High | 7.8 | 2021-10-07 | When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loadin… |
CVE-2021-31819 | Critical | 9.8 | 2021-09-22 | In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other bas… |
CVE-2021-31820 | High | 7.5 | 2021-08-18 | In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the U… |
CVE-2021-31817 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-31816 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-31818 | Medium | 4.3 | 2021-06-17 | Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API requ… |
CVE-2021-30183 | High | 7.5 | 2021-05-14 | Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the pass… |
CVE-2021-21270 | Medium | 6.2 | 2021-01-22 | OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC versi… |
CVE-2020-26161 | Medium | 6.1 | 2020-10-26 | In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header. |
CVE-2020-27155 | High | 7.5 | 2020-10-22 | An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trus… |
CVE-2020-25825 | High | 7.5 | 2020-10-12 | In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs. |
CVE-2020-24566 | High | 7.5 | 2020-09-09 | In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and… |
CVE-2020-16197 | Medium | 4.3 | 2020-08-25 | An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment… |
CVE-2020-14470 | Medium | 6.5 | 2020-06-19 | In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password. |
CVE-2020-12286 | Medium | 4.3 | 2020-04-28 | In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped… |
CVE-2020-10678 | High | 8.8 | 2020-03-19 | In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug… |
CVE-2019-19376 | Medium | 6.5 | 2019-11-28 | In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and c… |
CVE-2019-19375 | Medium | 5.3 | 2019-11-28 | In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The f… |
CVE-2019-19085 | Medium | 5.4 | 2019-11-18 | A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web s… |
CVE-2019-19084 | Medium | 4.3 | 2019-11-18 | In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, tri… |
CVE-2019-15698 | Medium | 4.3 | 2019-08-27 | In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is… |
CVE-2019-15508 | Medium | 6.5 | 2019-08-23 | In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstan… |
CVE-2019-15507 | Medium | 6.5 | 2019-08-23 | In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumsta… |
CVE-2019-14525 | Medium | 4.9 | 2019-08-05 | In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive valu… |
CVE-2019-14268 | Medium | 6.5 | 2019-07-25 | In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstances) could trigger a… |
CVE-2019-11632 | High | 8.1 | 2019-05-01 | In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permissi… |
CVE-2019-8944 | Medium | 6.5 | 2019-02-20 | An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users t… |
CVE-2018-18850 | High | 8.8 | 2018-10-31 | In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously cr… |
CVE-2018-12884 | Medium | 6.5 | 2018-06-26 | In Octopus Deploy 3.0 onwards (before 2018.6.7), an authenticated user with incorrect permissions may be able to create Accounts under the Infrastructure menu. |
CVE-2018-12089 | High | 7.5 | 2018-06-11 | In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster… |
CVE-2018-11320 | Critical | 9.8 | 2018-05-21 | In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs. |
CVE-2018-10581 | Medium | 5.4 | 2018-05-01 | In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments th… |
CVE-2018-10550 | High | 7.5 | 2018-04-30 | In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to. |
CVE-2018-9039 | Medium | 6.5 | 2018-03-27 | In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their… |
CVE-2018-5706 | High | 8.8 | 2018-01-16 | An issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions can modify teams to give themselves Administer System permission… |
CVE-2018-4862 | High | 8.8 | 2018-01-03 | In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure account in such a way as… |
CVE-2017-17665 | High | 8.8 | 2017-12-13 | In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass bec… |
CVE-2017-16810 | Medium | 5.4 | 2017-11-14 | Cross-site scripting (XSS) vulnerability in the All Variables tab in Octopus Deploy 3.4.0-3.13.6 (fixed in 3.13.7) allows remote attackers to inject arbitrary… |
CVE-2017-16801 | Medium | 5.4 | 2017-11-13 | Cross-site scripting (XSS) vulnerability in Octopus Deploy 3.7.0-3.17.13 (fixed in 3.17.14) allows remote authenticated users to inject arbitrary web script or… |
CVE-2017-15611 | Medium | 6.5 | 2017-10-19 | In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with e… |
CVE-2017-15610 | Medium | 6.5 | 2017-10-19 | An issue was discovered in Octopus before 3.17.7. When the special Guest user account is granted the CertificateExportPrivateKey permission, and Guest Access i… |