---
id: "CVE-2026-116835"
page: "https://infrastack.ai/live/CVE-2026-116835"
kind: "vulnerability"
aliases: ["CVE-2026-116835"]
title: "Octopus Server: OIDC custom claims let users impersonate other projects"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Octopus Server", "fixed": ["2026.2.13503", "2026.3.15894"], "affected": "> 2025.3.11571, < 2026.2.13503; >= 2026.3.0, < 2026.3.15894", "ecosystem": "vendor"}]
ecosystems: []
tags: ["octopus-deploy", "oidc", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "no-oidc-accounts", "octopus-cloud"]
published_at: "2026-11-12T14:17:23+00:00"
first_seen_at: "2026-11-12T14:38:37+00:00"
updated_at: "2026-11-12T14:40:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116835", "first_seen_at": "2026-11-12T14:38:37+00:00"}, {"source": "analyst", "url": "https://advisories.octopus.com/post/2026/sa2026-22/", "first_seen_at": "2026-11-12T14:40:59+00:00", "cites": ["https://advisories.octopus.com/post/2026/sa2026-22/"]}]
exploit_sources: []
---

# Octopus Server: OIDC custom claims let users impersonate other projects

Link for people: https://infrastack.ai/live/CVE-2026-116835 (this .md is for agents)

A user with permission to edit accounts can use custom claims on an OIDC account to make Octopus Server issue signed tokens that impersonate a different project. External systems that trust that project, such as cloud providers or other Octopus instances, may grant access. Applies to self-hosted Octopus Server (Linux or Windows) in the listed version ranges. Vendor rates it High (CVSS 8.7), knows of no exploitation and no mitigation; upgrade. Octopus Cloud is already patched and can skip it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Octopus Server affected > 2025.3.11571, < 2026.2.13503; >= 2026.3.0, < 2026.3.15894 fixed 2026.2.13503, 2026.3.15894

## How to check

Check your Octopus Server version (Configuration > Diagnostics, or the footer). Affected: 2025.3.x after 2025.3.11571, all 2025.4.x and 2026.1.x, 2026.2.x before 2026.2.13503, 2026.3.x before 2026.3.15894. Also review who holds the permission to edit accounts, and which external systems (cloud providers, other Octopus instances) trust Octopus OIDC project identities.

## Fix

Upgrade Octopus Server to 2026.2.13503 or 2026.3.15894 or later (latest 2026.3.16117). 2025.3.x/2025.4.x/2026.1.x users move to 2026.2.13503+.

## Timeline

- 2026-11-12T14:38:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116835
- 2026-11-12T14:40:59+00:00 analyst https://advisories.octopus.com/post/2026/sa2026-22/ — Read Octopus SA 2026-22: affected ranges, fixes; vendor says no known mitigation, no known exploitation; Octopus Cloud already patched. No social search done.

## Documents

- [advisory] Octopus Security Advisory 2026-22 https://advisories.octopus.com/post/2026/sa2026-22/

## From the sources

In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_