{"id":"CVE-2026-96414","kind":"vulnerability","aliases":["CVE-2026-96414"],"related":[],"title":"Octopus Server: forged auth cookies let a user gain administrator rights","description":"In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.","summary":"Octopus Server does not properly protect the integrity of authentication cookies, and it wrongly validates permissions for users who can view users or audit events. A logged-in user can combine these to escalate their privileges to Administrator.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Octopus Server","fixed":["2026.2.13487","2026.3.15875"],"affected":"2022.x > 2022.1.3143; 2023.x; 2024.x; 2025.x; 2026.x < 2026.2.13487; 2026.3 < 2026.3.15875","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["deployment-tooling","octopus-server","privilege-escalation","self-hosted","vendor"],"not_affected_if":["managed-hosting","octopus-cloud"],"how_to_check":"Run the Octopus Server version (Octopus.Server version command, or the version shown in the web UI footer) and compare: affected if 2022.x after 2022.1.3143, any 2023.x/2024.x/2025.x, 2026.x before 2026.2.13487, or 2026.3 before 2026.3.15875. Also check whether guest access is enabled (vendor rates critical then).","fix":"Upgrade Octopus Server to 2026.2.13487 or later (2022.x-2026.2.x), 2026.3.15875 or later (2026.3.x); vendor recommends latest 2026.3.16030","status":"open","published_at":"2026-11-11T07:17:36+00:00","first_seen_at":"2026-11-11T07:26:17+00:00","triaged_at":"2026-11-11T07:27:50+00:00","updated_at":"2026-11-11T07:29:03+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T07:27:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Octopus Server: forged auth cookies let a user gain administrator rights","impact":"high","summary":"Octopus Server does not properly protect the integrity of authentication cookies, and it wrongly validates permissions for users who can view users or audit events. A logged-in user can combine these to escalate their privileges to Administrator.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["octopus-server","self-hosted","deployment-tooling"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Low-privilege user becomes Administrator on the Octopus Server","analyst_note":"Find affected and fixed Octopus Server versions and the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-96414.","how_to_check":"- Check the installed Octopus Server version against the affected range in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-96414)\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"Octopus Server","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that run a self-hosted Octopus Server where some users hold permissions to view users or audit events. The sources do not list the affected versions, so check the NVD entry to confirm whether your version is in range.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4532,"output_tokens":545,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed Octopus Server versions and the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-96414.","search":"'-2026':13A,16A '-96414':14A,17A 'administr':10A,71B,115C 'affect':73C 'allow':95C 'assign':90C 'audit':56B,101C 'auth':4A 'authent':42B,82C 'combin':64B,84C 'cooki':5A,43B,83C 'could':103C 'cve':12A,15A 'deploy':21B 'deployment-tool':20B 'escal':28B,67B,108C 'event':57B,102C 'forg':3A 'gain':9A 'host':31B 'incorrect':86C 'insuffici':78C 'integr':40B,79C 'let':6A 'log':60B 'logged-in':59B 'octopus':1A,18A,24B,33B,76C 'octopus-serv':23B 'permiss':48B,89C 'privileg':27B,69B,110C 'privilege-escal':26B 'proper':37B 'protect':38B,80C 'result':104C 'right':11A 'self':30B 'self-host':29B 'server':2A,19A,25B,34B,77C 'tool':22B 'user':8A,50B,54B,62B,93C,99C,107C 'valid':47B,87C 'vendor':32B 'version':74C 'view':53B,98C 'wrong':46B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Octopus Server (Linux and Windows) on the affected versions. A logged-in user with permission to view users or audit events can forge authentication cookies and become Administrator; with guest access enabled the guest user can do it. Octopus Cloud is already patched; fixed versions are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-11T07:29:03Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-19/","run_id":3517},"products":{"at":"2026-11-11T07:29:03Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-19/","run_id":3517},"mitigations":{"at":"2026-11-11T07:29:03Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-19/","run_id":3517},"workarounds":{"at":"2026-11-11T07:29:03Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-19/","run_id":3517},"how_to_check":{"at":"2026-11-11T07:29:03Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-19/","run_id":3517},"who_affected":{"at":"2026-11-11T07:29:03Z","by":"analyst","doc":"https://advisories.octopus.com/post/2026/sa2026-19/","run_id":3517}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["octopusserver","server"],"ptokens":["octopus","server"],"labels":["deploymenttooling","high","octopusserver","privilegeescalation","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96414':14A,17A 'administr':10A 'auth':4A 'cooki':5A 'cve':12A,15A 'forg':3A 'gain':9A 'let':6A 'octopus':1A,18A 'right':11A 'server':2A,19A 'user':8A","search_b":"'administr':71B 'audit':56B 'authent':42B 'combin':64B 'cooki':43B 'deploy':21B 'deployment-tool':20B 'escal':28B,67B 'event':57B 'host':31B 'integr':40B 'log':60B 'logged-in':59B 'octopus':24B,33B 'octopus-serv':23B 'permiss':48B 'privileg':27B,69B 'privilege-escal':26B 'proper':37B 'protect':38B 'self':30B 'self-host':29B 'server':25B,34B 'tool':22B 'user':50B,54B,62B 'valid':47B 'vendor':32B 'view':53B 'wrong':46B","search_c":"'administr':115C 'affect':73C 'allow':95C 'assign':90C 'audit':101C 'authent':82C 'combin':84C 'cooki':83C 'could':103C 'escal':108C 'event':102C 'incorrect':86C 'insuffici':78C 'integr':79C 'octopus':76C 'permiss':89C 'privileg':110C 'protect':80C 'result':104C 'server':77C 'user':93C,99C,107C 'valid':87C 'version':74C 'view':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T07:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@octopus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96414","severity":null,"published_at":"2026-11-11T07:17:36+00:00","modified_at":"2026-11-11T07:17:36+00:00","first_seen_at":"2026-11-11T07:26:17+00:00","fetched_at":"2026-11-11T07:26:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96414:3517","url":"https://advisories.octopus.com/post/2026/sa2026-19/","severity":null,"published_at":"2026-11-11T07:29:03+00:00","modified_at":"2026-11-11T07:29:03+00:00","first_seen_at":"2026-11-11T07:29:03+00:00","fetched_at":"2026-11-11T07:29:03+00:00","note":"Read Octopus advisory 2026-19; versions, fix, no mitigation, no known exploitation. No code check: needs running server version, not repo-readable.","cites":["https://advisories.octopus.com/post/2026/sa2026-19/"]}],"documents":[{"id":123653,"url":"https://advisories.octopus.com/post/2026/sa2026-19/","title":"Octopus Security Advisory 2026-19","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}