CVE-2026-116870: Octopus Deploy Octopus Server vulnerability
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires a service account that has at least one OIDC identity configured. Deployments without such a service account are not described as exploitable by the available information.
What does an attacker need to attempt exploitation?
An attacker needs a suitably configured non-legitimate token issuer and must know or guess details of an OIDC identity configured on a service account. The issue concerns that issuer's token being accepted as belonging to a service account associated with a legitimate trusted issuer.