---
id: "CVE-2026-117341"
kind: "vulnerability"
aliases: ["CVE-2026-117341"]
title: "Octopus Server: user invitation codes written to the audit log"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Octopus Server", "fixed": ["2026.2.13438", "2026.3.15829"], "affected": "all 2019.x-2025.x; 2026.x < 2026.2.13438; 2026.3 < 2026.3.15829", "ecosystem": "vendor"}]
ecosystems: []
tags: ["audit-log", "invitation", "octopus-deploy", "octopus-server", "other", "self-hosted"]
not_affected_if: ["auth-required", "no-user-invitations", "octopus-cloud", "single-space-no-invitations"]
published_at: "2026-10-27T11:17:33+00:00"
first_seen_at: "2026-10-27T11:31:28+00:00"
updated_at: "2026-10-27T11:33:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117341", "first_seen_at": "2026-10-27T11:31:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T11:33:11+00:00"}]
---

# Octopus Server: user invitation codes written to the audit log

Creating a user invitation in affected self-hosted Octopus Server versions writes the invitation code to the audit event log. A user in the linked space with audit read permission can redeem an unclaimed invitation and escalate privileges, depending on the invited user's permissions. Vendor says no known mitigation and no known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Octopus Server affected all 2019.x-2025.x; 2026.x < 2026.2.13438; 2026.3 < 2026.3.15829 fixed 2026.2.13438, 2026.3.15829

## How to check

Check the Octopus Server version (Configuration > Diagnostics, or the footer). Affected: all 2019.x-2025.x, 2026.x before 2026.2.13438, and 2026.3 before 2026.3.15829. Also look in Configuration > Audit for user invitation events and for unclaimed invitations still outstanding.

## Fix

Upgrade Octopus Server to 2026.3.15829 or later (latest 2026.3.15973), or 2026.2.13438 or later on the 2026.2 line. Everything before 2026.2 (2019.x-2025.x, 2026.1.x) must move to one of these. Octopus Cloud is already patched. Also review audit log for exposed invitation codes and revoke unclaimed invitations.

## Timeline

- 2026-10-27T11:31:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117341
- 2026-10-27T11:33:11+00:00 analyst — Read Octopus advisory 2026-16 (vendor). Fixed 2026.2.13438 / 2026.3.15829; vendor's own table says 2026.2.13434 or greater for older lines (inconsistent with 13438 in Fix section; use 13438+ to be safe). No mitigation, not exploited per vendor. Cloud already patched. CVSS 7.7.

## Documents

- [advisory] Octopus Security Advisory 2026-16 https://advisories.octopus.com/post/2026/sa2026-16/

## From the sources

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_