Critical Octopus Server Flaw CVE-2023-31446 Allows Remote Code Execution

Key Takeaways

• A high-severity vulnerability (CVE-2026-101169) has been identified in Octopus Server.
• The flaw allows authenticated users to achieve remote code execution through insecure JSON deserialization.
• All Octopus Server deployments on both Linux and Microsoft Windows are affected across various versions, dating back to 2019.4.x.
• Patches are available, and users are strongly advised to upgrade immediately; Octopus Cloud instances have already been updated.

Octopus Server Vulnerability Enables Remote Code Execution

Octopus Deploy has recently disclosed a critical high-severity vulnerability within its Octopus Server product, which could allow authenticated attackers to execute arbitrary code on vulnerable servers. The flaw, designated CVE-2026-101169, stems from insecure JSON deserialization and impacts deployments on both Linux and Microsoft Windows operating systems.

The company issued Security Advisory 2026-10 on September 29, 2026, urging immediate upgrades for all customers, as no alternative mitigations are available. This vulnerability was discovered internally by Nathan Willoughby of Octopus Deploy on September 4, 2026, with patches subsequently released on September 14, 2026.

Technical Details of CVE-2026-101169

The vulnerability resides in how Octopus Server processes JSON data related to Environment and Project objects. An authenticated user possessing the necessary permissions to modify either of these objects can submit specially crafted JSON data. When Octopus Server attempts to deserialize this attacker-controlled content, the insecure deserialization flaw can be exploited to execute arbitrary code within the security context of the Octopus Server process.

It is important to note that successful exploitation necessitates an attacker already having valid access to the Octopus Server instance and sufficient privileges to modify an Environment or Project. This means the vulnerability primarily poses a risk from malicious insiders, compromised administrator accounts, or attackers who have gained delegated project permissions.

Potential Impact in Enterprise Environments

Despite requiring prior authentication, the potential impact of this vulnerability in enterprise settings can be substantial. Octopus Server frequently manages critical deployment credentials, automation workflows, infrastructure targets, and sensitive application configuration data. A successful exploit could allow an attacker to run code with the same privileges as the Octopus Server process, potentially granting access to or control over these sensitive resources.

The ultimate consequences depend on the specific privileges assigned to the Octopus Server process and its access to connected deployment infrastructure. Octopus Deploy has assigned a high severity rating to CVE-2026-101169, though the company has stated it is not aware of any public exploitation or malicious use of the vulnerability at the time of its disclosure.

Affected Versions and Remediation

The vulnerability impacts a wide range of Octopus Server versions, including all 2019.4.x releases, all 2020.x through 2025.x releases, and several branches of the 2026 series. Specifically, affected 2026 versions include:

• 2026.1.x versions earlier than 2026.1.11781
• 2026.2.x versions earlier than 2026.2.13441
• 2026.3.x versions earlier than 2026.3.15829
• 2026.4.x versions earlier than 2026.4.1619

Octopus Deploy stated that customers running Octopus Server version 2026.3.15829 or later are not affected, with the latest recommended release being version 2026.3.15863. For Octopus Cloud customers, no action is required, as all cloud instances have already been updated to patched versions by the company. The 2026.4.x release line was exclusively available to Octopus Cloud when the fix was initially released.

What You Should Do

• Upgrade Immediately: Organizations should upgrade their Octopus Server instances to the latest available version as soon as possible.
• Apply Specific Patches: If a full upgrade to the latest build is not feasible, install a fixed release appropriate to your current feature branch.
• Legacy Version Guidance: For older versions ranging from 2019.4.x through 2025.x, Octopus Deploy advises upgrading to version 2026.1.11781 or newer.
• 2026 Branch Upgrades: Users on the 2026.2 branch should install version 2026.2.13441 or later, while 2026.3 users should upgrade to version 2026.3.15829 or later.
• Review Permissions: Regularly audit and minimize permissions for users who can modify Environment or Project objects within Octopus Server to reduce the attack surface.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.