CVE-2026-102478
Received Received - Intake

Privilege Escalation in Octopus Server via Role Modification

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Octopus Deploy

Description
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was achievable due to improper validation of unsafe equivalence in inputs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-102478
EUVD
EUVD-2026-94154

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Octopus Deploy Octopus Server 2023.2.945
Octopus Deploy Octopus Server 2026.2.0
Octopus Deploy Octopus Server 2026.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1289 The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-102478 is a high-severity privilege escalation vulnerability in Octopus Server. An authenticated user with permission to modify roles can bypass access controls due to improper validation of unsafe equivalence in inputs. This allows attackers to weaken built-in roles and add their accounts to privileged teams.

Detection Guidance

Detecting this vulnerability requires checking the version of Octopus Server installed on your system. Compare the installed version against the affected versions listed in the advisory. Use commands like 'octopus.server version' on Windows or check the version file in the Octopus Server installation directory on Linux.

Impact Analysis

An attacker could gain elevated privileges within Octopus Server, potentially accessing sensitive data or performing unauthorized actions. This could lead to data breaches, unauthorized deployments, or further lateral movement within the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations may face legal penalties or reputational damage if such breaches occur.

Mitigation Strategies

Immediately upgrade Octopus Server to version 2026.3.15875 or later. If upgrading to the latest version is not possible, upgrade to the latest patched version within your current feature branch. Octopus Cloud customers are already protected as their instances have been updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart