CVE-2026-3236 — Octopus Deploy / Octopus Server

CVE-2026-3236

Octopus Deploy / Octopus Server PUBLISHED

Description (CNA)

In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.

Affected (CNA)

Vendor / product	Versions
Octopus Deploy / Octopus Server	affected 2023.0.0 before 2025.3.14761; affected 2025.4.0 before 2025.4.10409

CWE

CWE-863

References

https://advisories.octopus.com/post/2026/sa2026-02

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.