Octopus Server Flaw Lets Authenticated Attackers Execute Arbitrary Code
Octopus Server CVE-2026-101169 lets authenticated editors run code via insecure JSON deserialization; no exploitation is known.
Octopus Deploy disclosed CVE-2026-101169, a high-severity insecure JSON deserialization flaw in self-hosted Octopus Server on Linux and Windows. An authenticated user with permission to edit a project or environment can supply crafted JSON that may execute arbitrary code in the Octopus Server process, potentially exposing deployment variables, credentials, and connected infrastructure. Fixes were released on September 14, 2026, and disclosed on September 29; the recommended release is 2026.3.15863, with patched builds for the 2026.1, 2026.2, and 2026.3 branches. Octopus Cloud is already patched, no workaround is available, and the vendor reports no known public exploitation.
- CVE-2026-101169 is insecure JSON deserialization in Octopus Server.
- Authenticated users who can edit projects or environments can execute code.
- No workaround exists; Octopus Cloud instances are already patched.
- Octopus says it is not aware of public exploitation.
- Self-hosted servers should move to the listed patched branch builds.
- CVEs
- CVE-2026-101169
- Vendors
- Octopus Deploy
- Products
- Octopus ServerOctopus Cloud
- Organizations
- Octopus Deploy
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101169 | Authenticated deserialization RCE in Octopus Server | 8.7 | — |
From the original article
2 min read at gbhackers.com
Octopus Deploy has announced a high-severity vulnerability in Octopus Server that could allow authenticated users with project or environment editing permissions to execute arbitrary code within the Octopus Server process. Tracked as CVE-2026-101169, this issue stems from insecure JSON deserialization and affects multiple Octopus Server releases running on both Linux and Microsoft Windows. Organizations using […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.