Zero Radar
← feed
HighVulnerabilityCVE-2026-117341updated 27 Oct 2026, 12:48 UTC

Octopus Server: invitation codes leak into audit log

When someone invites a new user to Octopus Server, the invite code is saved in the audit log. A user who can read that log could copy the code and use it to get more access than they should have.

Official, 3 sources
SeverityHighCVSS 7.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Invitation createdInvite code is generated for a new user
  2. 2Code written to audit logCode is stored in the audit event log
  3. 3Space member reads logMember with permissions views the audit event
  4. 4Invitation redeemedAttacker redeems the unclaimed invitation
  5. ResultAttacker gains the invited user's privileges

What happened

In affected Octopus Server versions, creating a user invitation writes the invitation code to the audit event log; for space-linked invitations, users in that space with suitable permissions can read it and redeem the unclaimed invitation.

Why it is dangerous: A user in the same space could take over an invitation meant for someone else and potentially escalate privileges, depending on the permissions assigned to the invited account. The BSI advisory also notes multiple other Octopus Deploy vulnerabilities allowing security bypass, information disclosure, privilege escalation, file manipulation and arbitrary code execution.

Are you affected?

You are affected if you run an affected version of Octopus Server and use space-linked user invitations.

Octopus Server versions affected by CVE-2026-117341 (GHSA-gfh4-mmcc-43wr); exact version range not stated in the provided material.

What to do

  1. Check your Octopus Server version against the GitHub advisory GHSA-gfh4-mmcc-43wr and the vendor's security notice
  2. Update Octopus Server to the fixed version once it is confirmed in the advisory
  3. Review pending user invitations and revoke any you do not recognize
  4. Limit who holds permissions in spaces that use invitations

Timeline

  1. 27 Oct 2026, 11:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 11:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 11:17 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 12:43 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  5. 27 Oct 2026, 12:48 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-117341 · GHSA-gfh4-mmcc-43wr
CVSS
7.7 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 11:17 UTC
On Zero Radar
27 Oct 2026, 11:17 UTC (0 min after disclosure)
Last change
27 Oct 2026, 12:48 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Octopus Server: invitation codes leak into audit log · Zero Radar