CVE-2026-14163
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In affected versions of Octopus Server, sensitive variables may be printed in clear-text in the deployment variable snapshot under certain circumstances.
Risk Assessment
Risk of exposing sensitive data (e.g., passwords, keys) to those with access to deployment snapshots.
Recommendation
Update Octopus Server to a patched version and review snapshots for sensitive data.
Other vulnerabilities in Octopus Server
See all- CVE-2026-8296Medium
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.
- CVE-2026-4881Medium
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.
Original NVD description (English source)
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.