CVE-2026-116870
Received Received - Intake

OIDC Token Validation Bypass in Octopus Server

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: Octopus Deploy

Description
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116870
EUVD
EUVD-2026-110722

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Octopus Deploy Octopus Server 2024.1.0
Octopus Deploy Octopus Server 2026.2.0
Octopus Deploy Octopus Server 2026.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1289 The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Octopus Server involves inconsistent validation of OIDC token issuers. It allows tokens from non-legitimate issuers to be accepted as valid for service accounts from trusted issuers. Exploitation requires a service account with at least one configured OIDC identity and knowledge of certain identity details.

Detection Guidance

Detection involves checking Octopus Server versions and reviewing OIDC token issuer configurations. Verify server version with commands like 'octopus.server version' or check installed package versions. Inspect OIDC identity configurations in the Octopus Server UI under service account settings. Look for unexpected or unauthorized OIDC issuers in logs located typically in /var/log/octopus or Octopus\Logs directory.

Impact Analysis

An attacker could impersonate a service account by using a token from a non-legitimate issuer. This could lead to unauthorized access, data breaches, or privilege escalation within the Octopus Server environment.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations must address this issue to maintain compliance and protect sensitive data.

Mitigation Strategies

Immediately upgrade Octopus Server to version 2026.3.15816 or higher. For cloud instances, no action is needed as they are already patched. For on-premises, download the latest version from Octopus Deploy and follow their upgrade documentation. Ensure all service accounts with OIDC identities are reviewed for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116870. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart