CVE-2026-96414: Octopus Deploy Octopus Server vulnerability

Published Nov 11, 2026

Updated

In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.

Affected Software

1 affected component

Octopus Deploy Octopus Server

Event History

Nov 11, 2026

CVE Published

via MITRE·07:01 AM

Data Sourced

via MITRE·07:01 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this privilege-escalation issue?

Authenticated Octopus Server users who are assigned permission to view users or audit events may be able to escalate their privileges to Administrator.

What access does an attacker need before exploiting the issue?

The attacker needs an existing user account with permissions that allow viewing users or audit events. The issue involves authentication cookies and incorrect validation of those assigned permissions.

CVE-2026-96414: Octopus Deploy Octopus Server vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this privilege-escalation issue?

What access does an attacker need before exploiting the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this privilege-escalation issue?

What access does an attacker need before exploiting the issue?