Octopus Server Sensitive Variable Plaintext Disclosure Vulnerability (CVE-2026-14163)

Vulnerability Overview Vulnerability Name: Security Advisory Sa2026-07 Publication Date: August 20, 2026 Discovery Date: May 27, 2026 Patch Release Date: June 30, 2026 Severity: High CVE ID: CVE-2026-14163 Vulnerability Description: In affected versions of Octopus Server, sensitive variables may be printed in plaintext within deployment variable snapshots under certain circumstances. Scope of Impact Affected Product: Octopus Server Operating System: Windows and Linux Affected Versions: - All 3.x versions (after 3.2.6) - All 4.x versions - All 2018.x, 2019.x, 2020.x, 2021.x, 2022.x, 2023.x, 2024.x, and 2025.x versions - All 2026.1.x versions (before 2026.1.11587) - All 2026.2.x versions (before 2026.2.13190) Remediation Fixed Versions: - 2026.1.11587 - 2026.2.13190 Upgrade Recommendations: - If the current version is 3.2.6 or higher, upgrade to version 2026.1.11587 or later. - If the current version is 4.x, 2018.x, 2019.x, 2020.x, 2021.x, 2022.x, 2023.x, 2024.x, or 2025.x, upgrade to version 2026.1.11587 or later. - If the current version is 2026.1.x, upgrade to version 2026.1.11587 or later. - If the current version is 2026.2.x, upgrade to version 2026.2.13190 or later. Download Links: - Latest Version: https://octopus.com/downloads - Previous Versions: https://octopus.com/downloads/previous Additional Information Mitigations: There are currently no known mitigations. It is recommended to upgrade to the fixed versions as soon as possible. Support: If you have any questions or concerns, please contact the support team: https://octopus.com/support Exploitation and Public Disclosure: The Octopus Deploy security team has not found any public disclosures or malicious exploitation of this vulnerability. Source: This vulnerability was reported by an Octopus Deploy customer.

Goal Reached Thanks to every supporter — we hit 100%!

Octopus Server Sensitive Variable Plaintext Disclosure Vulnerability (CVE-2026-14163)