CVE-2026-91778: 
Octopus Deploy vulnerability analysis and mitigation

CVE-2026-91778 is an Incorrect Authorization vulnerability in Octopus Server that allows authenticated users with certain scoped permission sets to execute arbitrary scripts on workers — including the Octopus Server built-in worker — beyond their assigned authorization level. The flaw stems from inadequate permission validation during script execution, enabling privilege escalation without the user possessing the required authorization. Affected versions span from 2019.0.0 through multiple 2026 release lines, with fixed versions at 2026.1.11725, 2026.2.13344, and 2026.3.11816. It was published on September 15, 2026, with a CVSS v4.0 base score of 7.2 (High) (GitHub Advisory, Octopus Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the product performs an authorization check when a user attempts to execute a script, but does not correctly enforce that check at execution time. Specifically, users with certain scoped permission sets can trigger script execution on workers — including the built-in Octopus Server worker — because the permission validation logic fails to properly verify the user's authorization scope before allowing the script to run. The attack vector is network-based, requires low privileges (an authenticated account with scoped permissions), no user interaction, and no special attack complexity or prerequisites (GitHub Advisory, Octopus Advisory).

Successful exploitation allows an authenticated user to execute arbitrary scripts on Octopus workers, including the built-in Octopus Server worker, beyond their authorized permission scope. This results in high integrity and availability impact on the vulnerable system — an attacker could modify deployment configurations, disrupt CI/CD pipelines, or interfere with automated processes. While direct confidentiality impact on the vulnerable system is rated None in the CVSS scoring, arbitrary script execution on workers could indirectly expose secrets, credentials, or deployment artifacts accessible to those workers (GitHub Advisory, Octopus Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated account with at least some scoped permissions within the Octopus Server environment, limiting the attack surface to internal or semi-trusted users (GitHub Advisory, Octopus Advisory).

1. Obtain a low-privilege account: Acquire or use an existing Octopus Server account that has at least some scoped permissions (e.g., permissions scoped to a specific project or environment).
2. Identify script execution functionality: Navigate to the Octopus Server interface and locate features that allow script execution on workers, such as the Script Console or runbook/deployment step configuration.
3. Craft a script payload: Prepare an arbitrary script (e.g., PowerShell or Bash) intended to perform actions beyond the user's authorized scope — such as accessing other environments, modifying deployment targets, or exfiltrating worker-accessible secrets.
4. Submit script for execution: Trigger script execution targeting a worker (including the built-in Octopus Server worker). Due to the flawed permission validation, the server fails to correctly verify the user's authorization scope and executes the script.
5. Achieve unauthorized actions: The script runs on the worker with the worker's privileges, potentially enabling access to deployment secrets, modification of pipeline configurations, or disruption of automated processes (GitHub Advisory, Octopus Advisory).

• Logs: Octopus Server audit logs showing script execution events initiated by users whose permission scopes should not permit execution on the targeted worker or environment; unexpected script execution entries in task logs for users with limited scoped permissions.
• Process: Unexpected processes spawned by the Octopus worker service (e.g., PowerShell, bash, or other scripting runtimes) that are inconsistent with scheduled deployments or runbooks.
• Network: Outbound connections from the Octopus worker host to unusual external endpoints initiated during or after unexpected script execution events.
• File System: Unexpected files written to worker host directories by the Octopus worker process, particularly scripts or binaries not associated with known deployments (Octopus Advisory).

Octopus Deploy has released patched versions addressing this vulnerability: 2026.1.11725, 2026.2.13344, and 2026.3.11816. Organizations running any version from 2019.0.0 onward should upgrade to the appropriate patched release immediately. As interim measures, administrators should review and audit permission sets for all users with scoped permissions, restrict access to script execution features where possible, and implement additional monitoring around worker script execution activity (Octopus Advisory, GitHub Advisory).