CVE-2026-12702 | Medium | 4.9 | 2026-07-24 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment. |
CVE-2026-8296 | | | 2026-06-19 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts. |
CVE-2026-4881 | Medium | 6.5 | 2026-06-04 | In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes usin… |
CVE-2026-3237 | Medium | 4.3 | 2026-03-17 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocati… |
CVE-2026-3236 | Medium | 4.3 | 2026-03-05 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exc… |
CVE-2026-0704 | Critical | 9.1 | 2026-02-25 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation w… |
CVE-2025-0539 | High | 8.8 | 2025-04-10 | In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allo… |
CVE-2025-0588 | Medium | 4.9 | 2025-02-11 | In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifi… |
CVE-2025-0526 | Medium | 5.4 | 2025-02-11 | In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation w… |
CVE-2025-0513 | Medium | 5.4 | 2025-02-11 | In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they… |
CVE-2025-0525 | High | 7.5 | 2025-02-11 | In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversar… |
CVE-2025-0589 | Medium | 5.3 | 2025-02-11 | In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API… |
CVE-2024-12226 | Medium | 6.5 | 2025-01-16 | In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was i… |
CVE-2024-1656 | Low | 2.6 | 2024-09-11 | Affected versions of Octopus Server had a weak content security policy. |
CVE-2024-7998 | Low | 2.6 | 2024-08-21 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan. |
CVE-2024-6972 | Medium | 6.5 | 2024-07-25 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text. |
CVE-2024-4811 | Low | 2.2 | 2024-07-25 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts. |
CVE-2024-4456 | Medium | 4.1 | 2024-05-08 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page. |
CVE-2024-4226 | Low | 3.5 | 2024-04-30 | It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This fu… |
CVE-2023-4509 | Medium | 4.3 | 2024-04-18 | It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt. |
CVE-2024-2975 | High | 8.8 | 2024-04-09 | A race condition was identified through which privilege escalation was possible in certain configurations. |
CVE-2023-1904 | Medium | 4.2 | 2023-12-14 | In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server. |
CVE-2022-2416 | Medium | 5.5 | 2023-08-02 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment. |
CVE-2022-2346 | Medium | 5.5 | 2023-08-02 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints. |
CVE-2022-4870 | Medium | 5.3 | 2023-05-18 | In affected versions of Octopus Deploy it is possible to discover network details via error message |
CVE-2022-4008 | Medium | 5.5 | 2023-05-10 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
CVE-2023-2247 | Medium | 5.3 | 2023-05-02 | In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function |
CVE-2022-2507 | Medium | 5.3 | 2023-04-19 | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage |
CVE-2022-4009 | High | 8.8 | 2023-03-16 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation |
CVE-2022-2259 | Medium | 4.3 | 2023-03-13 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items |
CVE-2022-2258 | Medium | 4.3 | 2023-03-13 | In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items |
CVE-2022-2883 | High | 7.5 | 2023-02-22 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
CVE-2022-4898 | Medium | 5.4 | 2023-01-31 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially res… |
CVE-2022-3614 | Medium | 6.1 | 2023-01-03 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirec… |
CVE-2022-3460 | High | 7.5 | 2023-01-03 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. |
CVE-2022-2721 | High | 7.5 | 2022-11-25 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verb… |
CVE-2022-2572 | Critical | 9.8 | 2022-11-01 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/dele… |
CVE-2022-2782 | Critical | 9.1 | 2022-10-27 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. |
CVE-2022-2508 | Medium | 5.3 | 2022-10-27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose erro… |
CVE-2022-2780 | High | 8.1 | 2022-10-14 | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the… |
CVE-2022-2828 | Medium | 6.5 | 2022-10-13 | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerabi… |
CVE-2022-2720 | Medium | 5.3 | 2022-10-12 | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partial… |
CVE-2022-2783 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token |
CVE-2022-2781 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables. |
CVE-2022-2778 | Critical | 9.8 | 2022-09-30 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. |
CVE-2022-2760 | Medium | 4.3 | 2022-09-28 | In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a re… |
CVE-2022-2528 | Medium | 6.5 | 2022-09-09 | In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages. |
CVE-2022-2075 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation. |
CVE-2022-2074 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. |
CVE-2022-2049 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. |
CVE-2022-1901 | Medium | 5.3 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview. |
CVE-2022-30532 | Medium | 5.3 | 2022-07-19 | In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy. |
CVE-2022-29890 | Medium | 6.1 | 2022-07-15 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. |
CVE-2022-1881 | Medium | 5.3 | 2022-07-15 | In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports fro… |
CVE-2022-2013 | High | 7.5 | 2022-06-13 | In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have ac… |
CVE-2022-1670 | High | 7.5 | 2022-05-19 | When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this r… |
CVE-2022-1502 | Medium | 4.3 | 2022-05-04 | Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView… |
CVE-2022-23184 | Medium | 6.1 | 2022-02-07 | In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects. |
CVE-2021-31821 | Medium | 5.5 | 2022-01-19 | When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in pla… |
CVE-2021-31822 | High | 7.8 | 2021-11-24 | When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged… |
CVE-2021-26557 | High | 7.8 | 2021-10-07 | When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-load… |
CVE-2021-26556 | High | 7.8 | 2021-10-07 | When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loadin… |
CVE-2021-31819 | Critical | 9.8 | 2021-09-22 | In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other bas… |
CVE-2021-31820 | High | 7.5 | 2021-08-18 | In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the U… |
CVE-2021-31817 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-31816 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-31818 | Medium | 4.3 | 2021-06-17 | Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API requ… |