CVE-2026-91778 — Octopus Deploy / Octopus Server

CVE-2026-91778

Octopus Deploy / Octopus Server PUBLISHED

Description (CNA)

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission validation during script execution would allow the script to execute without the user possessing the required authorisation.

Affected (CNA)

Vendor / product	Versions
Octopus Deploy / Octopus Server	affected 2019.0.0 before 2026.1.11725; affected 2026.2.0 before 2026.2.13344; affected 2026.3.0 before 2026.3.11816

CWE

CWE-863

References

https://advisories.octopus.com/post/2026/sa2026-08

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.