CVE-2026-8296: XSS
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Limit artifact upload/create permissions so only trusted administrators or roles can add artifacts. Audit role assignments and remove artifact-upload capability from lower-privileged users.
Octopus Server artifact upload permission (access levels) = restricted to trusted administrative roles - Compensating control
Temporarily restrict access to artifact upload and management endpoints (for example via firewall rules, network ACLs, or a WAF) to trusted IP ranges or hosts until permanent fixes or configuration changes are applied.
- Operational
Audit existing artifacts for embedded scripts or XSS payloads and remove or sanitize any malicious items. Review server logs for uploads or accesses that indicate exploitation and remediate any discovered incidents.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8296?
The severity of CVE-2026-8296 is rated as medium with a score of 5.6.
How do I fix CVE-2026-8296?
To fix CVE-2026-8296, apply the latest security updates provided for the affected versions of Octopus Server.
What type of vulnerability is CVE-2026-8296?
CVE-2026-8296 is a Cross-Site Scripting (XSS) vulnerability.
What versions of Octopus Server are affected by CVE-2026-8296?
CVE-2026-8296 affects certain versions of Octopus Server when specific access levels are utilized.
What risk does CVE-2026-8296 pose?
CVE-2026-8296 poses a risk of executing malicious scripts in the context of a user's browser, leading to potential data breaches or unauthorized actions.