OCTOPUS SERVER · CVE-2026-93487 · Runtime
FIX → 2026.3.15863 +1 ✓ verified
Octopus Server does not properly validate permissions for users who create project triggers. A user with trigger rights can run runbooks or create deployments they are not authorised to perform.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Octopus Server (Linux and Windows) where users have been given permission to create project triggers. Such a user can run runbooks or create deployments they are not authorised to perform. Octopus Cloud instances are already updated; installs on 2026.2.13487+ or 2026.3.15863+ can skip it.
Not affected if no-project-triggers-granted, octopus-cloud, patched-version
Who cares authorization, ci-cd, octopus-deploy, self-hosted
2026.2.13487, or 2026.3 before 2026.3.15863In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2026.3.15863 +1
2026.2.13487 or later on the 2019.x–2026.2 lines, or 2026.3.15863 or later on 2026.3 (latest is 2026.3.16030)