CVE-2026-3237

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-17 · updated 2026-06-17
Weakness: CWE-285

Description

In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.

Affected products

Octopus Deploy Octopus Server: before 2025.3.14731; from 2025.4.51 before 2025.4.10359; from 2026.1.675 before 2026.1.5571 — fixed in 2025.3.14731, 2025.4.10359, 2026.1.5571

How to fix

Upgrade to a fixed version: Octopus Deploy Octopus Server 2025.3.14731, 2025.4.10359, 2026.1.5571. Check the vendor advisory for mitigations.

References

https://advisories.octopus.com/post/2026/sa2026-03

Get alerted when CVE-2026-3237 or the next vulnerability affects your stack