Vulnerability in Octopus Deploy Octopus Server

[ Description ]Official description

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund26 Oct 2026WID-SEC-2026-4164

  Octopus Deploy: Multiple vulnerabilities Translated from German

  CVE-2026-116870CVE-2026-12887CVE-2026-117341+1 more CVEs

[ References ]References

• advisories.octopus.com/post/2026/sa2026-16