Live › vulnerability › CVE-2026-118426
With the LDAP authentication provider enabled, Octopus Server lets any authenticated user call the LDAP user search and LDAP group search functions. An attacker with a normal account can enumerate directory users and groups they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 04:41 UTC. All times on this page are UTC.
Octopus Server instances that use LDAP as the authentication provider are exposed; any account able to log in can reach the search functions. Instances using other authentication providers are not described as affected. The sources do not list affected version ranges.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.
This page as .md · .json · in your agent: get_signal("CVE-2026-118426")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.