OS
Product
Octopus Server
66
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 19Medium 37Low 4
Watch
Add Octopus Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0588 | 4.9 | Feb 11 | In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses Affected: 2020.1.0 before 2024.3.13097; 2024.4.401 before 2024.4.7091 |
| CVE-2019-14525 | 4.9 | Aug 5 | In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a… Affected: 2019.7.0 before 2019.7.6 |
| CVE-2026-3237 | 4.3 | Mar 17 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via… Affected: before 2025.3.14731; 2025.4.51 before 2025.4.10359; 2026.1.675 before 2026.1.5571 |
| CVE-2026-3236 | 4.3 | Mar 5 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original… Affected: 2023.1.4189 before 2025.3.14761; 2025.4.51 before 2025.4.10409 |
| CVE-2023-4509 | 4.3 | Apr 17 | It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt Affected: 2018.9.0 before 2023.4.296 |
| CVE-2022-2416 | 4.3 | Aug 2 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment Affected: 2019.4.0 before 2022.4.9997; 2023.1.4189 before 2023.1.10235; 2023.2.2028 before 2023.2.10545 |
| CVE-2022-2346 | 4.3 | Aug 2 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints Affected: 2019.4.0 before 2022.4.9997; 2023.1.4189 before 2023.1.10235; 2023.2.2028 before 2023.2.10545 |
| CVE-2022-2259 | 4.3 | Mar 13 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items Affected: 2019.1.0 before 2022.3.11098; 2022.4.791 before 2022.4.8463; 2023.1.4189 before 2023.1.9672; 2023.2.2028 |
| CVE-2022-2258 | 4.3 | Mar 13 | In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items Affected: 2019.1.0 before 2022.3.11098; 2022.4.791 before 2022.4.8463; 2023.1.4189 before 2023.1.9672; 2023.2.2028 |
| CVE-2022-2760 | 4.3 | Sep 28 | In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of… Affected: 2019.5.7 before 2022.1.3180; 2022.2.0 before 2022.2.7965; 2022.3.0 before 2022.3.10405 |
| CVE-2020-16197 | 4.3 | Aug 25 | An issue was discovered in Octopus Deploy 3.4 Affected: 3.4.0 |
| CVE-2019-15698 | 4.3 | Aug 27 | In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values Affected: 2019.7.3 through 2019.7.9 |
| CVE-2024-4226 | 3.5 | Apr 30 | It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions Affected: 2022.2.6729 before 2022.2.7934; 2022.3.348 before 2022.3.9163 |
| CVE-2024-1656 | 2.6 | Sep 11 | Affected versions of Octopus Server had a weak content security policy Affected: 2018.1.0 before 2024.2.9193 |
| CVE-2024-7998 | 2.6 | Aug 21 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan Affected: 2022.4.8332 before 2024.1.12931; 2024.2.101 before 2024.2.9313 |
| CVE-2024-4811 | 2.2 | Jul 25 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts Affected: 2023.1.4189 before 2023.4.8608; 2024.1.437 before 2024.1.12759; 2024.2.101 before 2024.2.9193 |