CVE-2026-78210: 
Octopus Deploy vulnerability analysis and mitigation

CVE-2026-78210 is an Incorrect Authorization vulnerability in Octopus Deploy's Octopus Server that allows authenticated users with certain scoped permission sets to execute arbitrary scripts in environments they are not authorized to access. The vulnerability affects Octopus Server versions from 2019.5.9 through 2026.1.11738, 2026.2.0 through 2026.2.13363, and 2026.3.0 through 2026.3.13950. It was published on October 1, 2026, with patches made available the same day. It carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, ENISA EUVD).

The root cause is classified as CWE-863 (Incorrect Authorization), meaning the server performs an authorization check when a user attempts to execute scripts but does not correctly enforce environment-level access controls. An authenticated attacker with low-privilege, scoped permissions can exploit this over the network (no special attack requirements or user interaction needed) by leveraging their existing permission set to trigger script execution in environments outside their authorized scope. The flaw suggests that permission boundary enforcement logic fails to properly validate environment-level authorization when certain permission combinations are present (GitHub Advisory, Octopus Advisory).

Successful exploitation allows an authenticated user with limited, scoped permissions to execute arbitrary scripts in deployment environments they should not have access to, resulting in a high integrity impact on the vulnerable system and a low availability impact. This could enable unauthorized modification of deployment pipelines, execution of malicious scripts against managed infrastructure, or interference with CI/CD workflows. While confidentiality impact on the vulnerable system itself is rated as none, the ability to run arbitrary scripts in unauthorized environments could facilitate lateral movement to systems managed by Octopus Server (GitHub Advisory, ENISA EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The NVD SSVC assessment confirms exploitation is "none" and the vulnerability is not automatable, requiring a low-privilege authenticated account to exploit. The EPSS score is approximately 0.257% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, ENISA EUVD).

1. Reconnaissance: Identify Octopus Server instances running affected versions (2019.5.9–2026.1.11738, 2026.2.0–2026.2.13363, or 2026.3.0–2026.3.13950) accessible over the network.
2. Obtain low-privilege credentials: Acquire or use an existing authenticated account with a scoped permission set (e.g., permissions scoped to a specific project or environment).
3. Identify target environment: Determine an environment within Octopus Server that the account is not authorized to access but that the authorization bypass may allow script execution in.
4. Trigger script execution: Craft and submit a script execution request (e.g., via the Octopus API or UI) targeting the unauthorized environment, exploiting the incorrect authorization check to bypass environment-level access controls.
5. Execute arbitrary scripts: The server incorrectly authorizes the request, allowing the attacker's scripts to run in the target environment, potentially affecting managed deployment targets (GitHub Advisory, Octopus Advisory).

• Logs: Octopus Server audit logs showing script execution events in environments that the executing user account is not assigned permissions for; unexpected task logs associated with low-privilege accounts running scripts in sensitive environments.
• Network: API calls (e.g., POST requests to Octopus Server script execution endpoints) originating from accounts with scoped/limited permissions targeting environments outside their defined scope.
• Behavioral: User accounts with project-scoped or environment-scoped permissions appearing in audit trails for environments they should not have access to; unexpected deployment or runbook script executions attributed to low-privilege users.

Octopus Deploy has released patched versions: 2026.1.11739, 2026.2.13364, and 2026.3.13951. Organizations should upgrade to one of these fixed versions as the primary remediation. As interim measures, administrators should audit and review permission assignments for all users with scoped permission sets, apply the principle of least privilege, and monitor audit logs for unauthorized script execution activity (Octopus Advisory, GitHub Advisory).