CVE-2026-3237: Low severity Octopus Deploy Octopus Server vulnerability
In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3237?
CVE-2026-3237 is classified as a medium severity vulnerability due to improper permission validation allowing low privileged users to manipulate API requests.
How do I fix CVE-2026-3237?
To fix CVE-2026-3237, ensure that proper permission validations are implemented for the vulnerable API endpoints in Octopus Server.
What versions of Octopus Server are affected by CVE-2026-3237?
CVE-2026-3237 affects certain unpatched versions of Octopus Server where the vulnerability exists.
What is the impact of exploiting CVE-2026-3237?
Exploiting CVE-2026-3237 allows a low privileged user to change the signing key expiration and revocation time frames, potentially leading to unauthorized access.
Is there a workaround for CVE-2026-3237?
As a temporary workaround for CVE-2026-3237, you can restrict access to the affected API endpoints until a patch is applied.