OCTOPUS SERVER · CVE-2026-96414 · Vendor
FIX → 2026.3.15875 +1 ✓ verified
Octopus Server does not properly protect the integrity of authentication cookies, and it wrongly validates permissions for users who can view users or audit events. A logged-in user can combine these to escalate their privileges to Administrator.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Octopus Server (Linux and Windows) on the affected versions. A logged-in user with permission to view users or audit events can forge authentication cookies and become Administrator; with guest access enabled the guest user can do it. Octopus Cloud is already patched; fixed versions are not affected.
Not affected if managed-hosting, octopus-cloud
Who cares deployment-tooling, octopus-server, privilege-escalation, self-hosted
2022.1.3143, any 2023.x/2024.x/2025.x, 2026.x before 2026.2.13487, or 2026.3 before 2026.3.15875In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2026.3.15875 +1
Upgrade Octopus Server to 2026.2.13487 or later (2022.x-2026.2.x), 2026.3.15875 or later (2026.3.x); vendor recommends latest 2026.3.16030