CVE-2026-3237

2.3 lowEPSS 0.2%

Low (2.3) in octopus octopus server. EPSS 0.2% chance of exploitation in the next 30 days.

In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.

Severity

CVSS 4.0

2.3 low

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
CWE: CWE-285
Published: 2026-03-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

octopus:octopus_server

References

https://advisories.octopus.com/post/2026/sa2026-03

Check your stack JSON