Skip to content
OpenAdvisories
Low · 2.3 CVE-2026-3237 EUVD-2026-12544

In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key exp…

Published Mar 17, 2026 · Updated Mar 17, 2026 · Assigned by Octopus

Vendor: Octopus Deploy Product: Octopus Server

Description

In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.

Affected products

VendorProductAffectedFixed
Octopus Deploy Octopus Server 2023.0.0 – < 2025.3.14731, 2025.4.0 – < 2025.4.10359, 2026.1.0 – < 2026.1.5571 2025.3.14731

Advisories 1

References