CVE-2026-101169

HighCVSS 8.7/10Last modified Sep 29, 2026

Description

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Octopus DeployOctopus Server>= 2019.4.1, < 2026.1.11781; >= 2026.2.0, < 2026.2.13441; >= 2026.3.0, < 2026.3.15829

References

Timeline

Published
Sep 29, 2026
Last modified
Sep 29, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-101174.3A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogs_pool_id_calloc in the library /lib/sbi/nghttp2-seCVE-2026-1011704.0DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011713.6Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect CVE-2026-1011726.2Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.CVE-2026-1011736.5DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011745.7DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011754.3Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-1011767.1Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affeCVE-2026-1011773.7Permission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentCVE-2026-1011786.6Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability may affect service coCVE-2026-1011794.7Buffer overflow vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-101187.8A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when
CVE-2026-101169: High severity, CVSS 8.7 | Vulnix