Hoch 8.7Software
CVE-2026-116835
Octopus Deploy: Mehrere Schwachstellen
Octopus Deploy Octopus Deploy
In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity.
12. Nov 2026
Original bei CERT-Bund öffnen