Octopus Server Vulnerability Allows Authenticated Code Execution via Insecure Deserialization
A critical vulnerability in Octopus Server, CVE-2026-101169, allows authenticated users to execute arbitrary code through insecure JSON deserialization, impacting specific Linux and Windows versions.
Octopus Deploy has disclosed a critical vulnerability, tracked as CVE-2026-101169, within its Octopus Server software. This flaw permits authenticated users with sufficient privileges to execute arbitrary code on affected servers by exploiting an insecure JSON deserialization process. The vulnerability impacts deployments on both Linux and Microsoft Windows operating systems.
Discovered internally by Nathan Willoughby of Octopus Deploy on September 4, 2026, the issue was addressed with patches released on September 14, 2026. Octopus Deploy issued Security Advisory 2026-10 on September 29, 2026, strongly urging customers to upgrade immediately due to the lack of available mitigations. The vulnerability resides in how Octopus Server processes JSON data associated with Environment and Project objects.
An attacker must already possess valid access to an Octopus Server instance and have the necessary permissions to edit either an Environment or a Project object. By submitting specially crafted JSON data, an authenticated user can trigger the insecure deserialization vulnerability. This allows for the execution of arbitrary code within the security context of the Octopus Server process itself.
While exploitation requires pre-existing access, the potential impact in enterprise environments is significant. Octopus Server often holds sensitive deployment credentials, manages automation workflows, interacts with infrastructure targets, and stores critical application configuration data. A successful exploit could allow a malicious insider, a compromised administrator account, or an attacker with delegated project permissions to gain control over the server's operations.
The vulnerability affects a wide range of Octopus Server versions, including all releases from 2019.4.x through 2025.x. Specifically, it impacts 2026.1.x versions prior to 2026.1.11781, 2026.2.x versions prior to 2026.2.13441, 2026.3.x versions prior to 2026.3.15829, and 2026.4.x versions prior to 2026.4.1619. Octopus Deploy notes that versions 2026.3.15829 and later are not affected.
Octopus Deploy recommends that all customers upgrade to the latest available version, which is currently 2026.3.15863. For those unable to immediately upgrade to the latest release, specific patched versions are available for different feature branches. Customers using legacy versions (2019.4.x to 2025.x) should upgrade to at least 2026.1.11781. Users of the 2026.2 branch should install version 2026.2.13441 or later, and 2026.3 users should upgrade to version 2026.3.15829 or later.
Octopus Cloud customers have already had their instances updated to patched versions by the company and do not need to take any action. Octopus Deploy has assigned this vulnerability a high severity rating. As of the disclosure date, the company stated it was not aware of any public exploitation or malicious use of CVE-2026-101169 in the wild.