Summary
Ein Angreifer kann mehrere Schwachstellen in Octopus Deploy ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um seine Privilegien zu erhöhen, um Dateien zu manipulieren, und um beliebigen Programmcode auszuführen.
Product
Octopus Deploy ist ein automatisierter Software-Bereitstellungs- und Release-Management-Server.
Vulnerabilities 4
-
High 8.7
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in…
-
High 8.6
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full …
-
High 7.7
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. W…
-
Medium 5.1
In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a …
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-110853
-
#1
Initiale Fassung
References
-
Octopus Security Advisory vom 2026-10-26
https://advisories.octopus.com/post/2026/sa2026-14/
-
Octopus Security Advisory vom 2026-10-26
https://advisories.octopus.com/post/2026/sa2026-15/
-
Octopus Security Advisory vom 2026-10-26
https://advisories.octopus.com/post/2026/sa2026-16/
-
Octopus Security Advisory vom 2026-10-26
https://advisories.octopus.com/post/2026/sa2026-17/