CVE-2026-116835: High severity vulnerability
In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must have permission to edit accounts in Octopus Server. The issue involves custom claims configured on OIDC accounts.
What systems could be affected beyond Octopus Server?
External systems that trust the identity of an Octopus project may be affected. Examples given include cloud providers and other Octopus instances.
What could an attacker gain through exploitation?
An attacker could cause Octopus Server to issue signed OIDC tokens impersonating a different project. Those tokens could grant the attacker access to external systems that trust the impersonated project's identity.