Zero Radar
← feed
HighVulnerabilityCVE-2026-117466updated 27 Oct 2026, 12:48 UTC

Octopus Server: users with System Manager role can gain full admin rights

A user with a limited management role on Octopus Server (a tool that deploys software) can take control of the whole system and act as an administrator. Anyone with that role could do far more than they should.

Official, 3 sources
SeverityHighCVSS 8.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Low-privilege userHolds the System Manager role
  2. 2Octopus ServerPrivilege check can be bypassed
  3. 3Admin rights gainedEscalated to full Administrator
  4. 4Full system controlDeployments and secrets accessible
  5. ResultAttacker controls the Octopus Server

What happened

In affected Octopus Server versions, a user holding the System Manager role can escalate privileges to full system Administrator. CERT-Bund also reports several other vulnerabilities in Octopus Deploy that allow security bypass, information disclosure, file manipulation and arbitrary code execution.

Why it is dangerous: A low-privilege account holder could gain full control of the deployment server, which typically holds credentials and controls releases to production systems. Organizations relying on Octopus Deploy are at risk.

Are you affected?

You are affected if you run an affected version of Octopus Server and have users assigned the System Manager role.

Octopus Server, affected versions not specified in the provided material. Octopus Deploy generally (CERT-Bund).

What to do

  1. Check your Octopus Server version and compare it against the vendor advisory GHSA-vg7p-mchq-388x
  2. Update Octopus Server to the fixed version listed in the advisory
  3. Review which accounts hold the System Manager role and remove it where not strictly needed

Timeline

  1. 27 Oct 2026, 11:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 11:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 11:17 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 12:43 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  5. 27 Oct 2026, 12:48 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-117466 · GHSA-vg7p-mchq-388x
CVSS
8.6 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 11:17 UTC
On Zero Radar
27 Oct 2026, 11:17 UTC (0 min after disclosure)
Last change
27 Oct 2026, 12:48 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Octopus Server: users with System Manager role can gain full admin rights · Zero Radar