Octopus Deploy discloses two privilege flaws in Octopus Server

Octopus Deploy discloses two privilege flaws in Octopus Server

9 November 2026: Octopus Deploy has published two high-severity advisories for Octopus Server, the self-hosted version of its deployment automation tool. CVE-2026-96414 lets a user with modest permissions escalate to Administrator, and CVE-2026-93487 lets a user run runbooks or create deployments they are not allowed to. Both were patched in late September and disclosed on 9 November.

From viewing users to running the server

CVE-2026-96414, advisory 2026-19, combines two weaknesses: authentication cookies without enough integrity protection, and incorrect permission checks for users who can view users or audit events. Together they let such a user raise their privileges to those of an Administrator. Octopus rates it high, but says that where guest access is enabled the flaw can be exploited as the guest user, which makes it critical.

Affected are all 2022.x versions after 2022.1.3143, every 2023.x, 2024.x and 2025.x version, 2026.x before 2026.2.13487 and 2026.3 before 2026.3.15875.

Triggers that skip the permission check

CVE-2026-93487, advisory 2026-20, is narrower. Octopus did not validate correctly who may create project triggers, so a user able to create a trigger could use one to run runbooks or start deployments beyond their own rights. The affected range is wider in time: every version after 2019.11.x, through 2025.x, plus 2026.x before 2026.2.13487 and 2026.3 before 2026.3.15863.

In a deployment tool that difference matters. A trigger that starts a production deployment or a runbook with stored credentials is a way to act on the systems Octopus deploys to, not only on Octopus itself.

Versions to move to

Line	Fixed for 2026-19	Fixed for 2026-20
2026.2	2026.2.13487	2026.2.13487
2026.3	2026.3.15875	2026.3.15863

Octopus recommends going straight to the latest release, 2026.3.16030, which covers both, on Windows and Linux. Teams on older feature lines from 2019 to 2025 need to move to 2026.2.13487 or later, since no fix is offered on those lines. Octopus Cloud instances have already been updated and need nothing.

Checks while the upgrade waits

Octopus states no exploitation on either page. The quick check for 2026-19 is whether guest access is enabled, because that is what turns it critical. For 2026-20, the project triggers created since the server was last upgraded, and the deployments and runbook runs they started, show whether anyone has used the gap. Discovery dates were 4 September and 27 August, so the window between a fix being available and the advisories going public was about six weeks.

Related on TrustList:

• Gitea 28.3.0 fixes 20 flaws, from account takeover to leaked secrets
• GitLab patches CVSS 10 remote code flaw in its CI/CD regex compiler
• Blacksmith raises a Sequoia-led Series C at a $1bn valuation

Sources

• Octopus Deploy: Security Advisory 2026-19, CVE-2026-96414, 9 November 2026, 9 November 2026
• Octopus Deploy: Security Advisory 2026-20, CVE-2026-93487, 9 November 2026, 9 November 2026