CVE-2026-3236: Low severity Octopus Deploy Octopus Server vulnerability
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3236?
CVE-2026-3236 has a high severity rating due to the potential for unauthorized access and extended API key lifetime.
How do I fix CVE-2026-3236?
To fix CVE-2026-3236, update to the latest version of Octopus Server that includes the security patch.
What impact does CVE-2026-3236 have on Octopus Server?
CVE-2026-3236 allows an attacker to create a new API key with an extended lifetime, compromising the system's security.
Which versions of Octopus Server are affected by CVE-2026-3236?
CVE-2026-3236 affects all versions of Octopus Server prior to the latest security update.
Is there a workaround for CVE-2026-3236?
Currently, the best approach for CVE-2026-3236 is to upgrade Octopus Server, as no official workarounds are provided.