Vulnerabilidades en Octopus Deploy
80 resultadosCVE-2026-78210HIGHIn affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without EPSS 0.3%CVE-2024-4456MEDIUMIn affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.EPSS 0.3%CVE-2024-7998LOWIn affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespEPSS 0.2%CVE-2024-1656LOWAffected versions of Octopus Server had a weak content security policy.EPSS 0.2%CVE-2024-4811LOWIn affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacEPSS 0.2%CVE-2025-0513LOWIn affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of theEPSS 0.2%CVE-2026-12887MEDIUMIn affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the scEPSS 0.2%CVE-2026-117466HIGHIn affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.EPSS 0.2%CVE-2024-6972MEDIUMIn affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in cEPSS 0.2%CVE-2023-4509MEDIUMIt is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.EPSS 0.2%CVE-2022-2781—In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and vEPSS 0.2%CVE-2026-117341HIGHIn affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation isEPSS 0.2%CVE-2026-116870HIGHIn affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from EPSS 0.2%CVE-2021-31822—When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to aEPSS 0.2%CVE-2026-4881MEDIUMIn affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make serverEPSS 0.2%CVE-2026-102488HIGHIn affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtaEPSS 0.2%CVE-2021-31821—When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus SeEPSS 0.2%CVE-2022-4008MEDIUMIn affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of ServiceEPSS 0.2%CVE-2026-3236LOWIn affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key haEPSS 0.2%CVE-2026-3237LOWIn affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiEPSS 0.2%