---
id: CVE-2026-116870
title: >-
  In affected versions of Octopus Server, OIDC token issuer validation was
  performed inconsistently
summary: >-
  In affected versions of Octopus Server, OIDC token issuer validation was
  performed inconsistently. This could result in a token issued from a suitably
  configured non legitimate issuer being accepted as a token belonging to a
  service acco…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-1289
vendor: Octopus Deploy
product: Octopus Server
affected:
  - octopus_server >= 2024.1.0 < 2026.1.11781
  - octopus_server >= 2026.2.0 < 2026.2.13438
  - octopus_server >= 2026.3.0 < 2026.3.15816
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T10:28:11.007Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116870'
references:
  - url: 'https://advisories.octopus.com/post/2026/sa2026-15'
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.296Z'
epss: 0.00226
epssPercentile: 0.1338
---

## Overview

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.

## Affected

- `octopus_server >= 2024.1.0 < 2026.1.11781`
- `octopus_server >= 2026.2.0 < 2026.2.13438`
- `octopus_server >= 2026.3.0 < 2026.3.15816`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.