CVE-2026-116870
CVE-2026-116870
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.
CVSS 8.7 · Élevée · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
octopus server
- Versions du logiciel
- ≥ 2024.1.0, < 2026.1.11781: Concernée (custom)
- ≥ 2026.2.0, < 2026.2.13438: Concernée (custom)
- ≥ 2026.3.0, < 2026.3.15816: Concernée (custom)
Mettez à jour vers 2026.1.11781; Mettez à jour vers 2026.2.13438; Mettez à jour vers 2026.3.15816