OCTOPUS SERVER · CVE-2026-116835 · Vendor
FIX → 2026.3.15894 +1 ✓ verified
A user with permission to edit accounts can use custom claims on an OIDC account to make Octopus Server issue signed tokens that impersonate a different project. External systems that trust that project, such as cloud providers or other Octopus instances, may grant access. Applies to self-hosted Octopus Server (Linux or Windows) in the listed version ranges. Vendor rates it High (CVSS 8.7), knows of no exploitation and no mitigation; upgrade. Octopus Cloud is already patched and can skip it.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running a self-hosted Octopus Server that uses OIDC accounts and trusts project identity tokens in cloud providers or other Octopus instances. The sources do not list affected versions, so check the vendor advisory before assuming exposure. Instances that do not use OIDC accounts are likely unaffected, but the sources do not confirm this.
Not affected if managed-hosting, no-oidc-accounts, octopus-cloud
Who cares octopus-deploy, oidc, self-hosted
2025.3.11571, all 2025.4.x and 2026.1.x, 2026.2.x before 2026.2.13503, 2026.3.x before 2026.3.15894In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 2026.3.15894 +1
Upgrade Octopus Server to 2026.2.13503 or 2026.3.15894 or later (latest 2026.3.16117). 2025.3.x/2025.4.x/2026.1.x users move to 2026.2.13503+.