CVE-2026-102478: High severity Octopus Deploy Octopus Server vulnerability
Published Oct 7, 2026
·Updated
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.
Affected Software
1 affected component
Octopus Deploy Octopus Server
Event History
Oct 7, 2026
CVE Published
via MITRE·01:17 AM
Data Sourced
via MITRE·01:17 AM
DescriptionWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must already be authenticated and have permission to modify roles. It is therefore most relevant where role-management permissions are granted to users who should not be able to influence privileged access.
2
What is the potential impact of successful exploitation?
An attacker could weaken a built-in role and add their account to a privileged team, resulting in privilege escalation.