{"id":"CVE-2026-116835","kind":"vulnerability","aliases":["CVE-2026-116835"],"related":[],"title":"Octopus Server: OIDC custom claims let users impersonate other projects","description":"In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity.","summary":"A user with permission to edit accounts can use custom claims on an OIDC account to make Octopus Server issue signed tokens that impersonate a different project. External systems that trust that project, such as cloud providers or other Octopus instances, may grant access. Applies to self-hosted Octopus Server (Linux or Windows) in the listed version ranges. Vendor rates it High (CVSS 8.7), knows of no exploitation and no mitigation; upgrade. Octopus Cloud is already patched and can skip it.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Octopus Server","fixed":["2026.2.13503","2026.3.15894"],"affected":"> 2025.3.11571, < 2026.2.13503; >= 2026.3.0, < 2026.3.15894","ecosystem":"vendor"}],"ecosystems":[],"tags":["octopus-deploy","oidc","self-hosted","vendor"],"not_affected_if":["managed-hosting","no-oidc-accounts","octopus-cloud"],"how_to_check":"Check your Octopus Server version (Configuration > Diagnostics, or the footer). Affected: 2025.3.x after 2025.3.11571, all 2025.4.x and 2026.1.x, 2026.2.x before 2026.2.13503, 2026.3.x before 2026.3.15894. Also review who holds the permission to edit accounts, and which external systems (cloud providers, other Octopus instances) trust Octopus OIDC project identities.","fix":"Upgrade Octopus Server to 2026.2.13503 or 2026.3.15894 or later (latest 2026.3.16117). 2025.3.x/2025.4.x/2026.1.x users move to 2026.2.13503+.","status":"open","published_at":"2026-11-12T14:17:23+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:00+00:00","updated_at":"2026-11-12T14:40:59+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-12T14:39:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Octopus Server: OIDC custom claims let users impersonate other projects","impact":"high","summary":"In affected Octopus Server versions, a user who can edit accounts can make the server sign OIDC tokens that claim to be a different project. External systems that trust that project's identity, such as cloud providers or other Octopus instances, may then grant that user access.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["octopus-deploy","oidc","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker impersonates another project to external cloud systems","analyst_note":"Find the affected version range and fixed release in the Octopus Server security advisory; NVD page lacks product data.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-oidc-accounts"],"who_is_affected":"Teams running a self-hosted Octopus Server that uses OIDC accounts and trusts project identity tokens in cloud providers or other Octopus instances. The sources do not list affected versions, so check the vendor advisory before assuming exposure. Instances that do not use OIDC accounts are likely unaffected, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4564,"output_tokens":483,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected version range and fixed release in the Octopus Server security advisory; NVD page lacks product data.","search":"'-116835':13A,16A '-2026':12A,15A '8.7':91B 'access':70B,147C 'account':33B,41B,121C,129C 'affect':109C 'allow':122C 'alreadi':103B 'appli':71B 'caus':131C 'claim':5A,37B,118C 'cloud':62B,101B,153C 'could':145C 'custom':4A,36B,117C 'cve':11A,14A 'cvss':90B 'deploy':21B 'differ':52B,142C 'edit':32B,128C 'exploit':95B 'extern':54B,149C 'grant':69B,146C 'high':89B 'host':25B,75B 'ident':164C 'imperson':8A,50B,140C 'instanc':67B,158C 'insuffici':114C 'issu':46B,135C 'know':92B 'let':6A 'linux':78B 'list':83B 'make':43B 'may':68B 'mitig':98B 'octopus':1A,17A,20B,44B,66B,76B,100B,112C,132C,157C 'octopus-deploy':19B 'oidc':3A,22B,40B,120C,137C 'patch':104B 'permiss':30B,126C 'project':10A,53B,59B,143C,162C 'provid':63B,154C 'rang':85B 'rate':87B 'self':24B,74B 'self-host':23B,73B 'server':2A,18A,45B,77B,113C,133C 'sign':47B,136C 'skip':107B 'system':55B,150C 'token':48B,138C 'trust':57B,160C 'upgrad':99B 'use':35B 'user':7A,28B,124C 'valid':115C 'vendor':26B,86B 'version':84B,110C 'window':80B","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Octopus Server that uses OIDC accounts and trusts project identity tokens in cloud providers or other Octopus instances. The sources do not list affected versions, so check the vendor advisory before assuming exposure. Instances that do not use OIDC accounts are likely unaffected, but the sources do not confirm this.","tier":"B","verified":{"fix":{"at":"2026-11-12T14:40:59Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-22/","run_id":3743},"products":{"at":"2026-11-12T14:40:59Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-22/","run_id":3743},"how_to_check":{"at":"2026-11-12T14:40:59Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-22/","run_id":3743}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["octopusserver","server"],"ptokens":["octopus","server"],"labels":["high","octopusdeploy","oidc","selfhosted","vendor"],"campaign_type":null,"search_a":"'-116835':13A,16A '-2026':12A,15A 'claim':5A 'custom':4A 'cve':11A,14A 'imperson':8A 'let':6A 'octopus':1A,17A 'oidc':3A 'project':10A 'server':2A,18A 'user':7A","search_b":"'8.7':91B 'access':70B 'account':33B,41B 'alreadi':103B 'appli':71B 'claim':37B 'cloud':62B,101B 'custom':36B 'cvss':90B 'deploy':21B 'differ':52B 'edit':32B 'exploit':95B 'extern':54B 'grant':69B 'high':89B 'host':25B,75B 'imperson':50B 'instanc':67B 'issu':46B 'know':92B 'linux':78B 'list':83B 'make':43B 'may':68B 'mitig':98B 'octopus':20B,44B,66B,76B,100B 'octopus-deploy':19B 'oidc':22B,40B 'patch':104B 'permiss':30B 'project':53B,59B 'provid':63B 'rang':85B 'rate':87B 'self':24B,74B 'self-host':23B,73B 'server':45B,77B 'sign':47B 'skip':107B 'system':55B 'token':48B 'trust':57B 'upgrad':99B 'use':35B 'user':28B 'vendor':26B,86B 'version':84B 'window':80B","search_c":"'access':147C 'account':121C,129C 'affect':109C 'allow':122C 'caus':131C 'claim':118C 'cloud':153C 'could':145C 'custom':117C 'differ':142C 'edit':128C 'extern':149C 'grant':146C 'ident':164C 'imperson':140C 'instanc':158C 'insuffici':114C 'issu':135C 'octopus':112C,132C,157C 'oidc':120C,137C 'permiss':126C 'project':143C,162C 'provid':154C 'server':113C,133C 'sign':136C 'system':150C 'token':138C 'trust':160C 'user':124C 'valid':115C 'version':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T14:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@octopus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116835","severity":null,"published_at":"2026-11-12T14:17:23+00:00","modified_at":"2026-11-12T14:17:23+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116835:3743","url":"https://advisories.octopus.com/post/2026/sa2026-22/","severity":null,"published_at":"2026-11-12T14:40:59+00:00","modified_at":"2026-11-12T14:40:59+00:00","first_seen_at":"2026-11-12T14:40:59+00:00","fetched_at":"2026-11-12T14:40:59+00:00","note":"Read Octopus SA 2026-22: affected ranges, fixes; vendor says no known mitigation, no known exploitation; Octopus Cloud already patched. No social search done.","cites":["https://advisories.octopus.com/post/2026/sa2026-22/"]}],"documents":[{"id":135690,"url":"https://advisories.octopus.com/post/2026/sa2026-22/","title":"Octopus Security Advisory 2026-22","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}