CVE-2026-91778

Octopus Server contains an incorrect authorization flaw (CWE-863) in which permission validation during script execution is performed incorrectly, allowing users holding certain scoped permission sets to execute arbitrary scripts on a worker, including the Octopus Server built-in worker, without actually possessing the required script-execution authorization. The flaw is triggered by an already-authenticated, low-privilege user invoking script execution through the normal deployment/script pathway, where the permission check fails to enforce the correct role. Successful abuse gives the attacker arbitrary code execution on the worker host, yielding high impact to that system's integrity and availability (CVSS 4.0: 7.2). Any organization running a self-hosted Octopus Server with custom or scoped teams/roles, or Octopus Cloud tenants with restricted users, is potentially affected. No public proof-of-concept exists and the issue is not listed in CISA's KEV, so exploitation status is currently none known.

What to do: Upgrade Octopus Server to the patched release identified in the vendor's advisory for CVE-2026-91778 as soon as the fixed version is confirmed. Audit custom roles, scoped permissions, and team membership for users who should not have script-execution rights, and review worker/script-step audit logs for unexpected script executions by low-privilege accounts. Consider disabling or tightly restricting use of the built-in worker and running deployment scripts on dedicated, least-privileged isolated workers to limit blast radius.