CVE-2026-118426: Octopus Octopus Server vulnerability
Published Oct 29, 2026
·Updated
In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.
Affected Software
1 affected component
Octopus Octopus Server
Event History
Oct 29, 2026
CVE Published
via MITRE·02:02 AM
Data Sourced
via MITRE·02:02 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any authenticated user can exploit it when the LDAP authentication provider is enabled in an affected Octopus Server deployment.
2
What functionality can an attacker access?
An authenticated user could call the LDAP user search and LDAP group search functions.
3
Is LDAP configuration required for exposure?
Yes. The issue applies to affected versions only when the LDAP authentication provider is enabled.