In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://advisories.octopus.com/post/2026/sa2026-03 |
Configurations
No configuration.
History
17 Mar 2026, 14:20
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-285 |
17 Mar 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-17 07:16
Updated : 2026-03-17 14:20
NVD link : CVE-2026-3237
Mitre link : CVE-2026-3237
CVE.ORG link : CVE-2026-3237
JSON object : View
Products Affected
No product.
CWE
CWE-285
Improper Authorization