CVE-2026-124628

Quick assessment

Affected

Octopus Deploy Octopus Server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在受影响的 Octopus Server 版本中，由于对用户修改自身 LDAP 身份信息的验证存在缺陷，即使用户管理员已禁用“自助式身份编辑”功能，用户仍可修改其 LDAP 身份。这可能导致用户被加入其原本不属于的外部 LDAP 组所映射的团队；若这些团队拥有特权，用户甚至可能借此提升权限，获得完整的系统管理员权限。

CVSS 8.7 · High Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1548.001 · Setuid and Setgid T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Octopus Deploy	Octopus Server	2018.3.0 ~ 2026.2.13526	-

II. Public POCs for CVE-2026-124628

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124628

请登录查看更多情报信息。

Other References for CVE-2026-124628 (1)

https://advisories.octopus.com/post/2026/sa2026-24

https://www.cve.org/CVERecord?id=CVE-2026-124628

Same Patch Batch · Octopus Deploy · 2026-11-12 · 3 CVEs total

CVE-2026-116835	8.7 HIGH	Octopus Server 特定版本 OIDC 令牌伪造漏洞
CVE-2026-124627	8.7 HIGH	Octopus Server 身份验证漏洞：LDAP 权限越权

IV. Related Vulnerabilities

Same product: Octopus Server

Same vendor: Octopus Deploy

Same weakness: CWE-863