Is CVE-2026-14163 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14163 being exploited in the wild.

How severe is CVE-2026-14163?

High severity, with a CVSS score of 7.5, published 20 August 2026.

Which products and versions are affected?

Octopus Deploy Octopus Server 3.2.7-3.x, 4.x, 2018.x, 2019.x, 2020.x, 2021.x, 2022.x, 2023.x, 2024.x, 2025.x, 2026.1.x before 2026.1.11587, 2026.2.x before 2026.2.13190.

Is there a fix for CVE-2026-14163?

A patch was published on 2026-06-30: Patch release date for versions 2026.1.11587 and 2026.2.13190 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14163 attacked?

It is attacked over the network or with local access, in a hosted service.

Am I affected by CVE-2026-14163?

Check whether you run Octopus Deploy Octopus Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14163: Octopus Server sensitive variables exposed in deployment snapshot

CVE-2026-14163 · Severity: high · CVSS 7.5 · Published 2026-08-20

Octopus Server is a deployment automation platform used to manage application releases across infrastructure. A vulnerability in certain versions allows sensitive variables—such as passwords, API keys, and database credentials—to be printed in plain-text within deployment variable snapshot files, potentially exposing confidential data to unauthorized users with access to the system.

Technologies: Octopus Deploy Octopus Server. Vendors: Octopus Deploy.

Quick answers

Is CVE-2026-14163 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14163 being exploited in the wild.
How severe is CVE-2026-14163?: High severity, with a CVSS score of 7.5, published 20 August 2026.
Which products and versions are affected?: Octopus Deploy Octopus Server 3.2.7-3.x, 4.x, 2018.x, 2019.x, 2020.x, 2021.x, 2022.x, 2023.x, 2024.x, 2025.x, 2026.1.x before 2026.1.11587, 2026.2.x before 2026.2.13190.
Is there a fix for CVE-2026-14163?: A patch was published on 2026-06-30: Patch release date for versions 2026.1.11587 and 2026.2.13190 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14163 attacked?: It is attacked over the network or with local access, in a hosted service.
Am I affected by CVE-2026-14163?: Check whether you run Octopus Deploy Octopus Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure flaw in Octopus Server's deployment variable snapshot generation. Under certain circumstances, sensitive variables that should be redacted or encrypted are instead recorded in clear-text in the snapshot JSON. The issue affects a broad range of versions from 3.x through 2026.1.x and early 2026.2.x releases. An attacker with local or network access to the deployment snapshot data can retrieve exposed credentials without additional authentication. The vulnerability has been patched in Octopus Server 2026.1.11587, 2026.2.13190, and later versions; customers are urged to upgrade immediately as no workaround exists.

Affected products

Octopus Deploy Octopus Server 3.2.7-3.x, 4.x, 2018.x, 2019.x, 2020.x, 2021.x, 2022.x, 2023.x, 2024.x, 2025.x, 2026.1.x before 2026.1.11587, 2026.2.x before 2026.2.13190

Timeline

2026-05-27: disclosed: Discovery date
2026-06-30: patched: Patch release date for versions 2026.1.11587 and 2026.2.13190
2026-08-20: advisory: Security Advisory 2026-07 published

References

https://advisories.octopus.com/post/2026/sa2026-07/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.