---
id: "CVE-2026-116870"
kind: "vulnerability"
aliases: ["CVE-2026-116870"]
title: "Octopus Server: inconsistent OIDC issuer checks let forged tokens authenticate"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Octopus Server", "fixed": ["2026.1.11781", "2026.2.13438", "2026.3.15816"], "affected": "2024.x after 2024.1.11865; 2025.x; 2026.1 < 2026.1.11781; 2026.2 < 2026.2.13438; 2026.3 < 2026.3.15816", "ecosystem": "vendor"}]
ecosystems: []
tags: ["octopus-server", "oidc", "package", "self-hosted", "service-account"]
not_affected_if: ["no-oidc-service-accounts", "octopus-cloud", "patched-version"]
published_at: "2026-10-27T11:17:28+00:00"
first_seen_at: "2026-10-27T11:31:27+00:00"
updated_at: "2026-10-27T11:33:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116870", "first_seen_at": "2026-10-27T11:31:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T11:33:15+00:00"}]
---

# Octopus Server: inconsistent OIDC issuer checks let forged tokens authenticate

Octopus Server validated the OIDC token issuer inconsistently. A token from a non-legitimate issuer can be accepted as belonging to a service account that trusts a legitimate issuer.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Octopus Server affected 2024.x after 2024.1.11865; 2025.x; 2026.1 < 2026.1.11781; 2026.2 < 2026.2.13438; 2026.3 < 2026.3.15816 fixed 2026.1.11781, 2026.2.13438, 2026.3.15816

## How to check

Check your Octopus Server version (Help/About or the web UI footer). Affected: 2024.x after 2024.1.11865, all 2025.x, 2026.1 before 2026.1.11781, 2026.2 before 2026.2.13438, 2026.3 before 2026.3.15816. Then check whether any service account has an OIDC identity configured; only those are exploitable.

## Fix

Upgrade Octopus Server to 2026.1.11781, 2026.2.13438 or 2026.3.15816 or later on your feature line (2024.x/2025.x go to 2026.1.11781+); latest is 2026.3.15973. Octopus Cloud already patched.

## Timeline

- 2026-10-27T11:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116870
- 2026-10-27T11:33:15+00:00 analyst — Read Octopus advisory 2026-15 (vendor, primary). Affected/fixed versions and no-mitigation statement taken from it; no public exploitation known per vendor; no PoC searched/found.

## Documents

- [advisory] Octopus Security Advisory 2026-15: OIDC Issuer Confusion https://advisories.octopus.com/post/2026/sa2026-15/

## From the sources

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_