---
id: "CVE-2026-118426"
kind: "vulnerability"
aliases: ["CVE-2026-118426"]
title: "Octopus Server: any logged-in user can search LDAP users and groups"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ldap", "octopus-deploy", "runtime", "self-hosted"]
not_affected_if: ["ldap-disabled", "other-auth-provider"]
published_at: "2026-10-29T04:18:35+00:00"
first_seen_at: "2026-10-29T04:41:58+00:00"
updated_at: "2026-10-29T04:43:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118426", "first_seen_at": "2026-10-29T04:41:58+00:00"}]
---

# Octopus Server: any logged-in user can search LDAP users and groups

With the LDAP authentication provider enabled, Octopus Server lets any authenticated user call the LDAP user search and LDAP group search functions. An attacker with a normal account can enumerate directory users and groups they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-29T04:41:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118426

## From the sources

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_