Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-3236

In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original A

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Octopus

Description

In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Octopus Deploy Octopus Server

Default version status: unaffected

  • 2023.0.0 to < 2025.3.14761affected
  • 2025.4.0 to < 2025.4.10409affected

References