Live › vulnerability › CVE-2026-116870
Go to dashboardOctopus Server validated the OIDC token issuer inconsistently. A token from a non-legitimate issuer can be accepted as belonging to a service account that trusts a legitimate issuer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Teams running Octopus Server that use service accounts with OIDC identities are the ones exposed. The sources do not name the affected versions. Installations that do not use OIDC service accounts are not described as exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Octopus Server | vendor | 2024.x after 2024.1.11865; 2025.x; 2026.1 < 2026.1.11781; 2026.2 < 2026.2.13438; 2026.3 < 2026.3.15816 | 2026.1.11781, 2026.2.13438, 2026.3.15816 |
2024.1.11865, all 2025.x, 2026.1 before 2026.1.11781, 2026.2 before 2026.2.13438, 2026.3 before 2026.3.158162026.1.11781, 2026.2.13438 or 2026.3.15816 or later on your feature line (2024.x/2025.x go to 2026.1.11781+); latest is 2026.3.15973Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-116870")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.