CVE-2026-117341
High
Description
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.
SeverityHigh
CVSS7.7
Exploit probability—
ProductOctopus Server
PublishedOct 27, 2026
First seenOct 27, 2026
Weakness typeCWE-532CWE-532
How to fix
Update
- Octopus Deploy Octopus Server2026.2.13438, 2026.3.15829 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Octopus Deploy Octopus Server | 2019.0.0 ≤ v < 2026.2.13438, 2026.3.0 ≤ v < 2026.3.15829 | 2026.2.13438, 2026.3.15829 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.