← CVE Intelligence

CVE-2026-3237

Octopus Deploy / Octopus Server PUBLISHED

Description (CNA)

In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.

Affected (CNA)

Vendor / productVersions
Octopus Deploy / Octopus Serveraffected 2023.0.0 before 2025.3.14731; affected 2025.4.0 before 2025.4.10359; affected 2026.1.0 before 2026.1.5571

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.