{"id":"CVE-2026-116870","kind":"vulnerability","aliases":["CVE-2026-116870"],"related":[],"title":"Octopus Server: inconsistent OIDC issuer checks let forged tokens authenticate","description":"In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.","summary":"Octopus Server validated the OIDC token issuer inconsistently. A token from a non-legitimate issuer can be accepted as belonging to a service account that trusts a legitimate issuer.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Octopus Server","fixed":["2026.1.11781","2026.2.13438","2026.3.15816"],"affected":"2024.x after 2024.1.11865; 2025.x; 2026.1 < 2026.1.11781; 2026.2 < 2026.2.13438; 2026.3 < 2026.3.15816","ecosystem":"vendor"}],"ecosystems":[],"tags":["octopus-server","oidc","package","self-hosted","service-account"],"not_affected_if":["no-oidc-service-accounts","octopus-cloud","patched-version"],"how_to_check":"Check your Octopus Server version (Help/About or the web UI footer). Affected: 2024.x after 2024.1.11865, all 2025.x, 2026.1 before 2026.1.11781, 2026.2 before 2026.2.13438, 2026.3 before 2026.3.15816. Then check whether any service account has an OIDC identity configured; only those are exploitable.","fix":"Upgrade Octopus Server to 2026.1.11781, 2026.2.13438 or 2026.3.15816 or later on your feature line (2024.x/2025.x go to 2026.1.11781+); latest is 2026.3.15973. Octopus Cloud already patched.","status":"open","published_at":"2026-10-27T11:17:28+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:31:41+00:00","updated_at":"2026-10-27T11:33:15+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-27T11:31:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Octopus Server: inconsistent OIDC issuer checks let forged tokens authenticate","impact":"high","summary":"Octopus Server validated the OIDC token issuer inconsistently. A token from a non-legitimate issuer can be accepted as belonging to a service account that trusts a legitimate issuer.","category":"package","nicknames":[],"who_cares":["octopus-server","oidc","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker authenticates as a service account with its privileges","analyst_note":"Find the affected and fixed Octopus Server versions and the vendor advisory in the NVD entry references.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-oidc-service-accounts"],"who_is_affected":"Teams running Octopus Server that use service accounts with OIDC identities are the ones exposed. The sources do not name the affected versions. Installations that do not use OIDC service accounts are not described as exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000534,"input_tokens":3349,"output_tokens":399,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Octopus Server versions and the vendor advisory in the NVD entry references.","search":"'-116870':13A,16A '-2026':12A,15A 'accept':48B,88C 'account':29B,54B,96C,106C 'affect':61C 'also':117C 'attack':115C 'attempt':136C 'authent':10A 'belong':50B,92C 'check':6A 'configur':83C,113C 'could':74C 'cve':11A,14A 'detail':124C 'exploit':102C,137C 'forg':8A 'guess':122C 'host':26B 'ident':112C,127C 'inconsist':3A,37B,72C 'issu':79C 'issuer':5A,36B,45B,59B,68C,86C,101C 'know':120C 'least':109C 'legitim':44B,58B,85C,99C 'let':7A 'need':118C 'non':43B,84C 'non-legitim':42B 'octopus':1A,17A,20B,30B,64C 'octopus-serv':19B 'oidc':4A,22B,34B,66C,111C 'one':110C 'order':129C 'packag':23B 'perform':71C 'posit':134C 'requir':103C 'result':75C 'self':25B 'self-host':24B 'server':2A,18A,21B,31B,65C 'servic':28B,53B,95C,105C 'service-account':27B 'suitabl':82C 'token':9A,35B,39B,67C,78C,91C 'trust':56B,100C 'valid':32B,69C 'version':62C 'would':116C","nicknames":[],"mitigations":[],"who_affected":"Teams running Octopus Server that use service accounts with OIDC identities are the ones exposed. The sources do not name the affected versions. Installations that do not use OIDC service accounts are not described as exposed.","tier":"B","verified":{"fix":{"at":"2026-10-27T11:33:15Z","by":"analyst","run_id":868},"mitigations":{"at":"2026-10-27T11:33:15Z","by":"analyst","run_id":868},"who_affected":{"at":"2026-10-27T11:33:15Z","by":"analyst","run_id":868}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@octopus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116870","severity":null,"published_at":"2026-10-27T11:17:28+00:00","modified_at":"2026-10-27T11:17:28+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116870:868","url":null,"severity":null,"published_at":"2026-10-27T11:33:15+00:00","modified_at":"2026-10-27T11:33:15+00:00","first_seen_at":"2026-10-27T11:33:15+00:00","fetched_at":"2026-10-27T11:33:15+00:00","note":"Read Octopus advisory 2026-15 (vendor, primary). Affected/fixed versions and no-mitigation statement taken from it; no public exploitation known per vendor; no PoC searched/found."}],"documents":[{"id":6143,"url":"https://advisories.octopus.com/post/2026/sa2026-15/","title":"Octopus Security Advisory 2026-15: OIDC Issuer Confusion","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}