CVE-2026-91778
Quick assessment
Affected
Octopus Deploy Octopus Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在受影响的 Octopus Server 版本中，拥有某些范围受限权限集的用户能够在 worker（包括 Octopus Server 内置 worker）上执行任意脚本。由于在脚本执行过程中权限验证存在缺陷，即使用户未获得相应的授权，脚本仍可能得以执行，从而导致权限检查失效，可能引发未授权执行的风险。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91778
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission validation during script execution would allow the script to execute without the user possessing the required authorisation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Octopus Deploy | Octopus Server | 2019.0.0 ~ 2026.1.11725 | - |
|
II. Public POCs for CVE-2026-91778
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91778
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-91778 (1)
IV. Related Vulnerabilities
Same weakness: CWE-863
-
CVE-2026-91851
MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer -
CVE-2026-91181
Data Retention Teams Endpoint Leaks Private Team Invite ID -
CVE-2026-19816
PackageKit: dnf5 backend ignores SIMULATE on RepoRemove -
CVE-2026-90942
Casdoor through 4.4.0 Private Key Exposure via Certificate E -
CVE-2026-55866
SpiceDBChecks involving relations with caveats can result in
V. Comments for CVE-2026-91778
No comments yet