CVE-2026-3237: 
Octopus Deploy vulnerability analysis and mitigation

CVE-2026-3237 is an improper authorization vulnerability in Octopus Server that allows a low-privileged authenticated user to manipulate API requests to change signing key expiration and revocation time frames via an API endpoint with incorrect permission validation. The signing keys themselves cannot be exposed through this vulnerability. Affected versions include Octopus Server prior to 2025.3.14731, 2025.4.x prior to 2025.4.10359, and 2026.1.x prior to 2026.1.5571. It was published on March 17, 2026, with a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (Octopus Advisory, EUVD).

The root cause is classified as CWE-285 (Improper Authorization), where an API endpoint fails to correctly validate the permissions of the requesting user before allowing modifications to signing key configuration parameters. A low-privileged authenticated user can craft or manipulate API requests targeting this endpoint to alter the expiration and revocation time frames associated with signing keys. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, though CVSS v4.0 notes attack requirements are present (AT:P), indicating some precondition beyond basic authentication may be needed (Octopus Advisory, EUVD).

Successful exploitation allows an attacker to extend the validity period of signing keys that should have expired or been revoked, potentially enabling the continued use of compromised or outdated signing keys beyond their intended lifecycle. This primarily affects the integrity of authenticated operations that rely on these signing mechanisms, as tokens or credentials signed with keys that should be invalid could remain accepted by the system. Confidentiality and availability are not directly impacted, and the signing key material itself cannot be extracted via this vulnerability (Octopus Advisory, EUVD).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability has an EPSS score of approximately 0.042%, indicating a low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Octopus Advisory, EUVD).

Octopus Deploy has released patched versions addressing this vulnerability. Users should update to one of the following based on their current branch: 2025.3.14731 or later, 2025.4.10359 or later (for 2025.4.x installations), or 2026.1.5571 or later (for 2026.1.x installations). As additional hardening measures, administrators should restrict API access, enforce authentication on all API requests, review recent API audit logs for unauthorized modifications to signing key parameters, and implement network-level access controls to limit exposure of Octopus Server API endpoints (Octopus Advisory).