CVE-2026-93487: Octopus Octopus Server vulnerability

Published Nov 11, 2026

Updated

In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.

Affected Software

1 affected component

Octopus Octopus Server

Event History

Nov 11, 2026

CVE Published

via MITRE·07:21 AM

Data Sourced

via MITRE·07:21 AM

DescriptionWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker needs permissions that allow them to create project triggers. The flaw is in validation of the permissions assigned to such a user.

What unauthorized actions could exploitation enable?

An affected user could run runbooks or create deployments that they were not otherwise authorized to perform.

CVE-2026-93487: Octopus Octopus Server vulnerability

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What unauthorized actions could exploitation enable?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What unauthorized actions could exploitation enable?