CVE-2026-3237

State: Published
Severity: 2.3 Low
Published: Mar 17, 2026
Updated: Mar 17, 2026
Reserved: Feb 26, 2026

Description

In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	Octopus

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
Octopus ServerOctopus Deploy	2023.0.0 to before 2025.3.14731Affected 2025.4.0 to before 2025.4.10359Affected 2026.1.0 to before 2026.1.5571Affected

References

https://advisories.octopus.com/post/2026/sa2026-03

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.