CVE-2026-78210
Received Received - Intake

Arbitrary Script Execution in Octopus Server

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Octopus Deploy

Description
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-78210
EUVD
EUVD-2026-90474

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
octopus_deploy octopus_server From 2019.5.9 (exc)
octopus_deploy octopus_server From 2020.0.0 (inc) to 2025.9999 (inc)
octopus_deploy octopus_server to 2026.1.11739 (exc)
octopus_deploy octopus_server to 2026.2.13364 (exc)
octopus_deploy octopus_server to 2026.3.13951 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Octopus Server allows users with certain limited permissions to run arbitrary scripts in an environment without having the proper authorization. It affects multiple versions of Octopus Server and was discovered internally by Octopus Deploy.

Detection Guidance

Check Octopus Server version against affected versions (2019.x after 2019.5.9, 2020.x-2025.x, 2026.x before 2026.1.11739, 2026.2.13364, 2026.3.13951). Review user permissions for scoped roles that may allow unauthorized script execution.

Impact Analysis

An attacker with scoped permissions could exploit this to execute unauthorized scripts, potentially leading to data breaches, system compromise, or unauthorized access to sensitive information within the Octopus Server environment.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, which may violate compliance requirements such as GDPR or HIPAA. Organizations using affected versions must upgrade to mitigate risks to compliance.

Mitigation Strategies

Upgrade Octopus Server to version 2026.3.15878 or the minimum patched versions (2026.1.11739, 2026.2.13364, 2026.3.13951). Octopus Cloud customers are already protected. No known mitigation exists besides upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart