CVE-2026-91778: Octopus Server Privilege Escalation Flaw

CVE-2026-91778 Overview

CVE-2026-91778 is an authorization bypass vulnerability in Octopus Server. Users holding certain scoped permission sets can execute arbitrary scripts on a worker, including the Octopus Server built-in worker. The flaw stems from incorrect permission validation during script execution, allowing scripts to run without the user possessing the required authorization. This is classified as [CWE-863] Incorrect Authorization. The vulnerability affects the confidentiality, integrity, and availability of workloads processed by Octopus workers and can be exploited over the network by an authenticated user with low privileges.

Critical Impact
Authenticated users with limited scoped permissions can execute arbitrary scripts on Octopus workers, including the built-in worker, potentially compromising deployment pipelines and connected infrastructure.

Affected Products

Octopus Server (affected versions per vendor advisory SA2026-08)
Octopus Server built-in worker
Deployment targets and external workers reachable through affected Octopus Server instances

Discovery Timeline

2026-09-15 - CVE-2026-91778 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91778

Vulnerability Analysis

Octopus Server executes deployment and runbook scripts on workers, which are execution hosts responsible for running steps against target environments. Access to script execution is intended to be gated by scoped permission sets that bind users to specific projects, environments, or tenants.

CVE-2026-91778 breaks that model. The authorization check performed at script execution time does not correctly enforce the scope of the caller's permissions. As a result, a user who has some legitimate script execution scope can execute scripts outside that scope, or execute scripts they should not be permitted to run at all.

Because the built-in worker runs in the security context of the Octopus Server process, arbitrary script execution on that worker exposes credentials, connection strings, and API tokens accessible to the server. External workers are similarly exposed within their own execution context.

Root Cause

The root cause is incorrect authorization ([CWE-863]) in the script execution code path. Permission validation occurs, but it does not fully account for the scope of the requesting user's permission set. The server treats a partially authorized request as sufficient to trigger execution on a worker.

Attack Vector

Exploitation requires network access to the Octopus Server API and authenticated credentials with a scoped permission set that includes any script execution capability. No user interaction is required. The attacker submits a script execution request targeting a worker; the server dispatches the script despite the scope mismatch, and the payload runs on the selected worker.

No verified public proof-of-concept exists at time of writing. See the Octopus Security Advisory SA2026-08 for vendor technical details.

Detection Methods for CVE-2026-91778

Indicators of Compromise

Script execution tasks in Octopus audit logs initiated by users whose scoped permissions should not cover the targeted project, environment, or tenant.
Ad-hoc script tasks or runbook runs originating from low-privileged accounts targeting the built-in worker.
Unexpected outbound network connections, credential access, or process spawns from the Octopus Server host or external worker processes.

Detection Strategies

Review the Octopus Server audit log and task history for Script and RunScript task types, correlating the initiating user's assigned scopes against the task's project and environment.
Alert on any script execution against the built-in worker performed by non-administrative accounts.
Baseline normal worker activity and flag deviations such as new script contents, uncommon command-line arguments, or execution outside deployment windows.

Monitoring Recommendations

Forward Octopus Server audit and task logs to a centralized logging platform for correlation with endpoint telemetry from worker hosts.
Monitor the Octopus Server process and external worker processes for child process creation, PowerShell or Bash invocations, and network egress that deviates from established deployment patterns.
Track authentication events for service accounts and API keys that have any script execution scope, and rotate credentials showing anomalous use.

How to Mitigate CVE-2026-91778

Immediate Actions Required

Upgrade Octopus Server to the fixed release identified in Octopus Security Advisory SA2026-08.
Inventory all users, teams, and API keys that hold any script execution permission and reduce scopes to the minimum required.
Rotate credentials, certificates, and API tokens that were accessible to the Octopus Server process or any affected worker.

Patch Information

Octopus has published fixed versions in security advisory SA2026-08. Administrators should consult the advisory for the exact patched build numbers that apply to their deployment channel and apply the update to all Octopus Server instances. After patching, verify the upgrade completed successfully and confirm that script execution permissions behave as expected against test scopes.

Workarounds

Restrict script execution permissions to trusted administrative roles until the patch is applied.
Disable or avoid use of the built-in worker; route deployment steps to dedicated external worker pools that run under least-privilege service accounts.
Isolate worker hosts on segmented networks and remove unnecessary credentials, cloud provider tokens, and secrets from their execution environment.

bash

# Example: list users and teams with script execution scopes for review
# Replace <OCTOPUS_URL> and <API_KEY> with values from a privileged admin account
curl -sS -H "X-Octopus-ApiKey: <API_KEY>" \
  "<OCTOPUS_URL>/api/users" | \
  jq '.Items[] | {Id, Username, DisplayName}'

curl -sS -H "X-Octopus-ApiKey: <API_KEY>" \
  "<OCTOPUS_URL>/api/teams" | \
  jq '.Items[] | {Id, Name}'