CVE-2025-0589: Medium severity octopus deploy vulnerability
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0589?
CVE-2025-0589 is considered a high-severity vulnerability due to its potential for data exposure.
How do I fix CVE-2025-0589?
To fix CVE-2025-0589, ensure that you update to the latest version of Octopus Deploy that addresses this vulnerability.
Which versions of Octopus Deploy are affected by CVE-2025-0589?
CVE-2025-0589 affects specific versions of Octopus Deploy that utilize Active Directory for authentication.
Can CVE-2025-0589 be exploited remotely?
Yes, CVE-2025-0589 can be exploited remotely as it allows unauthenticated users to make API requests.
What data can be exposed due to CVE-2025-0589?
CVE-2025-0589 could potentially expose sensitive data from the associated Active Directory.