{"id":"CVE-2026-117341","kind":"vulnerability","aliases":["CVE-2026-117341"],"related":[],"title":"Octopus Server: user invitation codes written to the audit log","description":"In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.","summary":"Creating a user invitation in affected self-hosted Octopus Server versions writes the invitation code to the audit event log. A user in the linked space with audit read permission can redeem an unclaimed invitation and escalate privileges, depending on the invited user's permissions. Vendor says no known mitigation and no known exploitation.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Octopus Server","fixed":["2026.2.13438","2026.3.15829"],"affected":"all 2019.x-2025.x; 2026.x < 2026.2.13438; 2026.3 < 2026.3.15829","ecosystem":"vendor"}],"ecosystems":[],"tags":["audit-log","invitation","octopus-deploy","octopus-server","other","self-hosted"],"not_affected_if":["auth-required","no-user-invitations","octopus-cloud","single-space-no-invitations"],"how_to_check":"Check the Octopus Server version (Configuration > Diagnostics, or the footer). Affected: all 2019.x-2025.x, 2026.x before 2026.2.13438, and 2026.3 before 2026.3.15829. Also look in Configuration > Audit for user invitation events and for unclaimed invitations still outstanding.","fix":"Upgrade Octopus Server to 2026.3.15829 or later (latest 2026.3.15973), or 2026.2.13438 or later on the 2026.2 line. Everything before 2026.2 (2019.x-2025.x, 2026.1.x) must move to one of these. Octopus Cloud is already patched. Also review audit log for exposed invitation codes and revoke unclaimed invitations.","status":"open","published_at":"2026-10-27T11:17:33+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","triaged_at":"2026-10-27T11:31:44+00:00","updated_at":"2026-10-27T11:33:11+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-27T11:31:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Octopus Server: user invitation codes written to the audit log","impact":"medium","summary":"Creating a user invitation in affected Octopus Server versions writes the invitation code to the audit event log. A user in the linked space with the right permissions can read that code and redeem the unclaimed invitation, which may allow privilege escalation depending on the invited user's permissions.","category":"other","nicknames":[],"who_cares":["octopus-deploy","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"A space user reads an invitation code and escalates privileges.","analyst_note":"Affected version range, the fixed release, and any mitigation are not in the sources; check the Octopus Deploy security advisory for CVE-2026-117341.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-user-invitations","auth-required"],"who_is_affected":"Teams running affected Octopus Server versions that send user invitations linked to a space. Exposure depends on who can read the audit event log and on the permissions granted to the invited user. Installations that never create invitations are not exposed by this flaw, as far as the sources say.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000557,"input_tokens":3336,"output_tokens":446,"severity_before":"high"},"analyst_status":"done","analyst_note":"Affected version range, the fixed release, and any mitigation are not in the sources; check the Octopus Deploy security advisory for CVE-2026-117341.","search":"'-117341':13A,16A '-2026':12A,15A 'affect':38B,89C 'allow':140C 'appropri':121C 'assign':153C 'audit':9A,20B,51B,61B,104C,129C 'audit-log':19B 'code':5A,48B,101C,126C 'could':123C,139C 'creat':33B,94C 'cve':11A,14A 'depend':72B,149C 'deploy':25B 'escal':70B,144C 'event':52B,105C,130C 'exploit':87B,132C 'host':32B,41B 'howev':146C 'invit':4A,22B,36B,47B,68B,75B,97C,100C,109C,138C,156C 'known':82B,86B 'link':58B,111C 'log':10A,21B,53B,106C 'mitig':83B 'octopus':1A,17A,24B,27B,42B,92C 'octopus-deploy':23B 'octopus-serv':26B 'permiss':63B,78B,122C,152C 'privileg':71B,145C 'read':62B,124C 'redeem':65B,135C 'say':80B 'self':31B,40B 'self-host':30B,39B 'server':2A,18A,28B,43B,93C 'space':59B,114C,119C 'success':131C 'unclaim':67B,137C 'user':3A,35B,55B,76B,96C,116C,142C,157C 'vendor':79B 'version':44B,90C 'write':45B,98C 'written':6A","nicknames":[],"mitigations":[],"who_affected":"Teams running affected Octopus Server versions that send user invitations linked to a space. Exposure depends on who can read the audit event log and on the permissions granted to the invited user. Installations that never create invitations are not exposed by this flaw, as far as the sources say.","tier":"B","verified":{"fix":{"at":"2026-10-27T11:33:11Z","by":"analyst","run_id":867},"products":{"at":"2026-10-27T11:33:11Z","by":"analyst","run_id":867},"mitigations":{"at":"2026-10-27T11:33:11Z","by":"analyst","run_id":867},"workarounds":{"at":"2026-10-27T11:33:11Z","by":"analyst","run_id":867},"how_to_check":{"at":"2026-10-27T11:33:11Z","by":"analyst","run_id":867},"who_affected":{"at":"2026-10-27T11:33:11Z","by":"analyst","run_id":867}},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@octopus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117341","severity":null,"published_at":"2026-10-27T11:17:33+00:00","modified_at":"2026-10-27T11:17:33+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","fetched_at":"2026-10-27T11:31:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117341:867","url":null,"severity":null,"published_at":"2026-10-27T11:33:11+00:00","modified_at":"2026-10-27T11:33:11+00:00","first_seen_at":"2026-10-27T11:33:11+00:00","fetched_at":"2026-10-27T11:33:11+00:00","note":"Read Octopus advisory 2026-16 (vendor). Fixed 2026.2.13438 / 2026.3.15829; vendor's own table says 2026.2.13434 or greater for older lines (inconsistent with 13438 in Fix section; use 13438+ to be safe). No mitigation, not exploited per vendor. Cloud already patched. CVSS 7.7."}],"documents":[{"id":6142,"url":"https://advisories.octopus.com/post/2026/sa2026-16/","title":"Octopus Security Advisory 2026-16","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}