CVE-2026-101169

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.

CWE	CWE-502
Vendor	octopus deploy
Product	octopus server
Published	Sep 29, 2026

Stay Ahead of the Next One

Get instant alerts for octopus deploy octopus server

Be the first to know when new unknown vulnerabilities affecting octopus deploy octopus server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Octopus Deploy / Octopus Server

2019.4.1 < 2026.1.11781 2026.2.0 < 2026.2.13441 2026.3.0 < 2026.3.15829

References

NVD ↗ CVE.org ↗ EPSS Data ↗

advisories.octopus.com: https://advisories.octopus.com/post/2026/sa2026-10

Credits

This vulnerability was found by Nathan Willoughby