CVE-2026-118426Medium· 5.3▾ SunlitIn affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.
octopus_server >= 3.0.0 < 2026.2.13487octopus_server >= 2026.3.0 < 2026.3.15909Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-12887Medium· 5.1In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.
CVE-2026-116870High· 8.7In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently
CVE-2026-117466High· 8.6In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
CVE-2026-117341High· 7.7In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log
CVE-2026-102488High· 8.7In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.
CVE-2026-102478High· 8.7In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation