Vulnerability in Octopus Deploy Octopus Server

[ Description ]Official description

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund28 Sep 2026WID-SEC-2026-3615

  Octopus Deploy: Vulnerability allows code execution Translated from German

  CVE-2026-101169

[ References ]References

• advisories.octopus.com/post/2026/sa2026-10