CVE-2026-116870

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://advisories.octopus.com/post/2026/sa2026-15

Weakness type (CWE)

CWE-1289

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://advisories.octopus.com/post/2026/sa2026-15/

Full discourse1 post

Venkata Satish Guttula 🛰️@snakeyesV115h
Octopus Deploy disclosed CVE-2026-116870 on Oct 27: inconsistent OIDC issuer validation could let an attacker impersonate a service account. Exploitation requires a configured OIDC identity and knowledge or guesses about its details. Fixes were released Sept 14 in 2026.1.11781, 2026.2.13438 and 2026.3.15816. The vendor reports no known malicious use. Check your server version. https://advisories.octopus.com/post/2026/sa2026-15/
0000038
3.3K followersView on X

Explore more

Back to dashboard