# Octopus Deploy Octopus Server vulnerabilities Source: https://junglewise.ai/threats/technologies/octopus-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 15:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/octopus-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in Octopus Deploy Octopus Server: 6 in the last 7 days and 17 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124628, was published on 12 November 2026. 5 vulnerabilities in the last four weeks, level on the four before (5). ## Counts - Last 7 days: 6 - Last 30 days: 11 - Last 90 days: 17 - All time: 20 (0 critical, 0 exploited in the wild) ## About Octopus Deploy Octopus Server Octopus Server is an automated deployment and release management server. ## Latest Octopus Deploy Octopus Server vulnerabilities - [CVE-2026-124628: Octopus Server authorization bypass in LDAP identity editing](https://junglewise.ai/threats/cve-2026-124628-in-affected-versions-of-octopus-server-incorrect-validation-of) (info, published 12 Nov 2026) - [CVE-2026-124627: Octopus Server LDAP identity injection leading to privilege escalation](https://junglewise.ai/threats/cve-2026-124627-in-affected-versions-of-octopus-server-incorrect-validation-of) (info, published 12 Nov 2026) - [CVE-2026-116835: Octopus Server OIDC claim validation bypass](https://junglewise.ai/threats/cve-2026-116835-in-affected-versions-of-octopus-server-insufficient-validation) (info, published 12 Nov 2026) - [CVE-2026-93487: Octopus Server incorrect authorization in project triggers](https://junglewise.ai/threats/cve-2026-93487-in-affected-versions-of-octopus-server-incorrect-validation-of) (info, published 11 Nov 2026) - [CVE-2026-105948: Octopus Server privilege escalation in LDAP login editing](https://junglewise.ai/threats/cve-2026-105948-in-affected-versions-of-octopus-server-incorrect-validation-of) (info, published 11 Nov 2026) - [CVE-2026-96414: Octopus Server authentication cookie forgery leading to privilege escalation](https://junglewise.ai/threats/cve-2026-96414-in-affected-versions-of-octopus-server-insufficient-integrity) (info, published 11 Nov 2026) - [CVE-2026-118426: Octopus Server LDAP directory enumeration](https://junglewise.ai/threats/cve-2026-118426-in-affected-versions-of-octopus-server-with-the-ldap) (info, published 29 Oct 2026) - [CVE-2026-12887: Octopus Server path traversal in NuGet package deployment](https://junglewise.ai/threats/cve-2026-12887-in-affected-versions-of-octopus-server-a-user-with-permission-to) (info, published 27 Oct 2026) - [CVE-2026-117466: Octopus Server privilege escalation in System Manager role](https://junglewise.ai/threats/cve-2026-117466-in-affected-versions-of-octopus-server-a-user-holding-the-system) (info, published 27 Oct 2026) - [CVE-2026-117341: Octopus Server invitation code exposure in audit log](https://junglewise.ai/threats/cve-2026-117341-in-affected-versions-of-octopus-server-creating-a-user) (info, published 27 Oct 2026) - [CVE-2026-116870: Octopus Server OIDC token issuer validation bypass](https://junglewise.ai/threats/cve-2026-116870-in-affected-versions-of-octopus-server-oidc-token-issuer) (info, published 27 Oct 2026) - [CVE-2026-102478: Octopus Server privilege escalation via unsafe role equivalence](https://junglewise.ai/threats/cve-2026-102478-in-affected-versions-of-octopus-server-an-authenticated-user) (info, published 7 Oct 2026) - [CVE-2026-78210: Octopus Server authorization bypass in script execution](https://junglewise.ai/threats/cve-2026-78210-in-affected-versions-of-octopus-server-users-with-certain-scoped) (info, published 1 Oct 2026) - [CVE-2026-101169: Octopus Server insecure deserialization in JSON](https://junglewise.ai/threats/cve-2026-101169-in-affected-versions-of-octopus-server-an-authenticated-user) (info, published 29 Sep 2026) - [CVE-2026-92355: Octopus Server path traversal in external feeds](https://junglewise.ai/threats/cve-2026-92355-octopus-server-path-traversal-in-external-feeds) (info, CVSS 8.7, published 16 Sep 2026) - [CVE-2026-91778: Octopus Deploy Server privilege escalation in script execution](https://junglewise.ai/threats/cve-2026-91778-octopus-deploy-server-privilege-escalation-in-script-execution) (info, CVSS 7.2, published 15 Sep 2026) - [CVE-2026-14163: Octopus Server sensitive variables exposed in deployment snapshot](https://junglewise.ai/threats/cve-2026-14163-octopus-server-sensitive-variables-exposed-in-deployment-snapshot) (high, CVSS 7.5, published 20 Aug 2026) - [CVE-2026-12702: Octopus Deploy incorrect authorization in project triggers](https://junglewise.ai/threats/cve-2026-12702-octopus-deploy-incorrect-authorization-in-project-triggers) (info, CVSS 5.1, published 24 Jul 2026) - [CVE-2026-8296: Octopus Deploy Octopus Server stored XSS in artifacts](https://junglewise.ai/threats/cve-2026-8296-octopus-deploy-octopus-server-stored-xss-in-artifacts) (info, CVSS 5.6, published 19 Jun 2026) - [CVE-2026-4881: Octopus Deploy Octopus Server broken access control in API endpoint](https://junglewise.ai/threats/cve-2026-4881-octopus-deploy-octopus-server-broken-access-control-in-api) (info, CVSS 6, published 4 Jun 2026) ## Most severe Octopus Deploy Octopus Server vulnerabilities - [CVE-2026-14163: Octopus Server sensitive variables exposed in deployment snapshot](https://junglewise.ai/threats/cve-2026-14163-octopus-server-sensitive-variables-exposed-in-deployment-snapshot) (high, CVSS 7.5, published 20 Aug 2026) - [CVE-2026-92355: Octopus Server path traversal in external feeds](https://junglewise.ai/threats/cve-2026-92355-octopus-server-path-traversal-in-external-feeds) (info, CVSS 8.7, published 16 Sep 2026) - [CVE-2026-91778: Octopus Deploy Server privilege escalation in script execution](https://junglewise.ai/threats/cve-2026-91778-octopus-deploy-server-privilege-escalation-in-script-execution) (info, CVSS 7.2, published 15 Sep 2026) - [CVE-2026-4881: Octopus Deploy Octopus Server broken access control in API endpoint](https://junglewise.ai/threats/cve-2026-4881-octopus-deploy-octopus-server-broken-access-control-in-api) (info, CVSS 6, published 4 Jun 2026) - [CVE-2026-8296: Octopus Deploy Octopus Server stored XSS in artifacts](https://junglewise.ai/threats/cve-2026-8296-octopus-deploy-octopus-server-stored-xss-in-artifacts) (info, CVSS 5.6, published 19 Jun 2026) - [CVE-2026-12702: Octopus Deploy incorrect authorization in project triggers](https://junglewise.ai/threats/cve-2026-12702-octopus-deploy-incorrect-authorization-in-project-triggers) (info, CVSS 5.1, published 24 Jul 2026) - [CVE-2026-78210: Octopus Server authorization bypass in script execution](https://junglewise.ai/threats/cve-2026-78210-in-affected-versions-of-octopus-server-users-with-certain-scoped) (info, published 1 Oct 2026) - [CVE-2026-124628: Octopus Server authorization bypass in LDAP identity editing](https://junglewise.ai/threats/cve-2026-124628-in-affected-versions-of-octopus-server-incorrect-validation-of) (info, published 12 Nov 2026) - [CVE-2026-124627: Octopus Server LDAP identity injection leading to privilege escalation](https://junglewise.ai/threats/cve-2026-124627-in-affected-versions-of-octopus-server-incorrect-validation-of) (info, published 12 Nov 2026) - [CVE-2026-116835: Octopus Server OIDC claim validation bypass](https://junglewise.ai/threats/cve-2026-116835-in-affected-versions-of-octopus-server-insufficient-validation) (info, published 12 Nov 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, level on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 5 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 6 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Octopus Deploy Octopus Server vulnerabilities", https://junglewise.ai/threats/technologies/octopus-server, 12 November 2026.