What is the vulnerability
CVE-2026-116870 is a vulnerability on a service called Octopus Server. Octopus Server is a service from Octopus Deploy, the popular CD(continuous deployment) company
CVE-2026-116870 is a input validation vulnerability where the input will pass the security checks even though the payload is malicious.
For example a attacker could use "%2e%2e%2f%2e%2e%2fetc%2fpasswd" instead of "../../etc/passwd" if it was a view file input. Keep in mind that this is just a example to give you a idea of obfuscation, the strings used here are unrelated to the vulnerability
CVE-2026-116870 was found on the 27th of october by security researcher Nathan Willoughby you can view his github here
Patching your server
Octopus has released the patch for this vulnerability. To view affected versions of Octopus Server aswell as more information click here
Top comments (0)