Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117341

Quick assessment

Affected
Octopus Deploy Octopus Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在受影响的 Octopus Server 版本中，创建用户邀请时会将邀请码写入审计事件日志。当该邀请与某个工作空间（Space）关联后，该工作空间中拥有相应权限的用户便可以从审计事件中读取该邀请码。若攻击者成功利用此漏洞并兑换该未被领取的邀请，则可能实现权限提升；但具体能否成功，取决于被邀请用户所分配的权限。

CVSS 7.7 · High

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117341

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Octopus Deploy Octopus Server 2019.0.0 ~ 2026.2.13438 -

II. Public POCs for CVE-2026-117341

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117341

请登录查看更多情报信息。

Other References for CVE-2026-117341 (1)

Same Patch Batch · Octopus Deploy · 2026-10-27 · 4 CVEs total

CVE-2026-116870 8.7 HIGH Octopus Server OIDC 令牌签发者验证不一致漏洞
CVE-2026-117466 8.6 HIGH Octopus Server 任意版本存在权限提升漏洞
CVE-2026-12887 5.1 MEDIUM Octopus Server 任意版本恶意 NuGet 包目录遍历漏洞

IV. Related Vulnerabilities

Same product: Octopus Server
Same vendor: Octopus Deploy
Same weakness: CWE-532