Vendor
Octopus Deploy
87 known vulnerabilities.
Octopus Deploy at a glance
- Last 12 months
- 25
- Critical · all time
- 4
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 6 | 0 |
| Oct 2026 | 8 | 0 |
| Sep 2026 | 3 | 0 |
| Aug 2026 | 2 | 0 |
| Jul 2026 | 1 | 0 |
| Jun 2026 | 2 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 2 | 0 |
| Feb 2026 | 1 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 5 | 0 |
| Jan 2025 | 1 | 0 |
| Dec 2024 | 0 | 0 |
Products
Octopus Server 79
Octopus Tentacle 4
Codefresh 1
OctopusDSC 1
Kubernetes Worker or Kubernetes Agent 1
Halibut 1
Octopus Deploy < 2022.4.8377 0
Octopus Deploy 0
Octopus Deploy < 2022.3.10750 0
Octopus Deploy < 2022.4.8221 0
Octopus Deploy < 2022.2.8552 0
Octopus Deploy < 2022.3.11098 0
Octopus Deploy < 2022.4.8463 0
Octopus Deploy < 2023.1.9672 0
Octopus Deploy < 2023.2.2394 0
Octopus Deploy < 2023.1.10235 0
Octopus Deploy < 2023.1.9879 0
Octopus Deploy < 2023.2.8159 0
Octopus Deploy < 2022.4.8319 0
Octopus Deploy < 2023.1.4189 0
Octopus Deploy < 2022.3.11043 0
Octopus Deploy < 2022.4.8401 0
Octopus Deploy < 2023.1.9794 0
Octopus Deploy < 2022.4.8332 0
Octopus Deploy < 2022.3.10957 0
Octopus Deploy < 2023.1.11942 0
Octopus Deploy < 2023.2.13151 0
Octopus Deploy < 2023.3.5049 0
Octopus Deploy < 2022.4.9997 0
Octopus Deploy < 2023.2.10545 0
Latest advisories
-
High max 8.7
Octopus Deploy: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Octopus Deploy ausnutzen, um Sicherheitsmaßnahmen zu umgehen und möglicherweise vollständige Administratorrechte zu erlangen.
first Nov 11, 2026 -
High max 7.7WID-SEC-2026-4477 1 CVE
Octopus Deploy: Schwachstelle ermöglicht Erlangen von Administratorrechten
Ein Angreifer kann eine Schwachstelle in Octopus Deploy ausnutzen, um Administratorrechte zu erlangen.
-
High max 8.7
Octopus Deploy: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Octopus Deploy ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Administratorrechte zu erlangen.
first Nov 9, 2026 -
Low max 5.3WID-SEC-2026-4239 1 CVE
Octopus Deploy: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Octopus Deploy ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.
-
High max 8.7
Octopus Deploy: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Octopus Deploy ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um seine Privilegien zu erhöhen, um Dateien zu manipulieren, und um beliebigen Programmcode auszuführen.
first Oct 26, 2026
87 results · Feed
-
High 8.7
In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed …
-
High 8.7
In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user…
-
High 8.7
In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with p…
-
High 7.7
In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to…
-
High 7.1
In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow the…
-
High 8.7
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with inco…
-
Medium 5.3
In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call…
-
Medium 5.1
In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a …
-
High 8.6
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full …
-
High 7.7
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. W…
-
High 8.7
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in…
-
High 8.7
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly pr…
-
High 8.7
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protecti…
-
High 7.1
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an…
-
High 8.7
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can se…
-
High 8.7
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a pa…
-
High 7.2
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a …
-
High 8.6
In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin pe…
-
High 7.1
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed…
-
Medium 5.1
In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user t…
-
Medium 5.6
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Paylo…
-
Medium 6.0
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user bein…
-
Low 2.3
In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change…
-
Low 2.3
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting …
-
Medium 5.9
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API…
-
Medium 5.9
In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests t…
-
Medium 5.9
In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all s…
-
Low 1.8
In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could co…
-
Low 2.3
In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API…
-
Low 2.3
In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a tar…
-
Medium 6.9
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible fo…
-
Medium 6.5
In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes …
-
Low 2.6
Affected versions of Octopus Server had a weak content security policy.
-
Low 2.6
In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them usi…
-
Medium 6.5
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed…
-
Low 2.2
In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restr…
-
Medium 4.1
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting paylo…
-
Low 3.5
It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all us…
-
Medium 4.3
It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.
-
High 8.8
A race condition was identified through which privilege escalation was possible in certain configurations.