---
id: "CVE-2026-96414"
page: "https://infrastack.ai/live/CVE-2026-96414"
kind: "vulnerability"
aliases: ["CVE-2026-96414"]
title: "Octopus Server: forged auth cookies let a user gain administrator rights"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Octopus Server", "fixed": ["2026.2.13487", "2026.3.15875"], "affected": "2022.x > 2022.1.3143; 2023.x; 2024.x; 2025.x; 2026.x < 2026.2.13487; 2026.3 < 2026.3.15875", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["deployment-tooling", "octopus-server", "privilege-escalation", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "octopus-cloud"]
published_at: "2026-11-11T07:17:36+00:00"
first_seen_at: "2026-11-11T07:26:17+00:00"
updated_at: "2026-11-11T07:29:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96414", "first_seen_at": "2026-11-11T07:26:17+00:00"}, {"source": "analyst", "url": "https://advisories.octopus.com/post/2026/sa2026-19/", "first_seen_at": "2026-11-11T07:29:03+00:00", "cites": ["https://advisories.octopus.com/post/2026/sa2026-19/"]}]
exploit_sources: []
---

# Octopus Server: forged auth cookies let a user gain administrator rights

Link for people: https://infrastack.ai/live/CVE-2026-96414 (this .md is for agents)

Octopus Server does not properly protect the integrity of authentication cookies, and it wrongly validates permissions for users who can view users or audit events. A logged-in user can combine these to escalate their privileges to Administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Octopus Server affected 2022.x > 2022.1.3143; 2023.x; 2024.x; 2025.x; 2026.x < 2026.2.13487; 2026.3 < 2026.3.15875 fixed 2026.2.13487, 2026.3.15875

## How to check

Run the Octopus Server version (Octopus.Server version command, or the version shown in the web UI footer) and compare: affected if 2022.x after 2022.1.3143, any 2023.x/2024.x/2025.x, 2026.x before 2026.2.13487, or 2026.3 before 2026.3.15875. Also check whether guest access is enabled (vendor rates critical then).

## Fix

Upgrade Octopus Server to 2026.2.13487 or later (2022.x-2026.2.x), 2026.3.15875 or later (2026.3.x); vendor recommends latest 2026.3.16030

## Timeline

- 2026-11-11T07:26:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96414
- 2026-11-11T07:29:03+00:00 analyst https://advisories.octopus.com/post/2026/sa2026-19/ — Read Octopus advisory 2026-19; versions, fix, no mitigation, no known exploitation. No code check: needs running server version, not repo-readable.

## Documents

- [advisory] Octopus Security Advisory 2026-19 https://advisories.octopus.com/post/2026/sa2026-19/

## From the sources

In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_