CVE-2026-8296
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to update Octopus Server to the latest version and review access levels to minimize the risk of malicious code injection.
Other vulnerabilities in Octopus Server
See all- CVE-2026-14163High
In affected versions of Octopus Server, sensitive variables may be printed in clear-text in the deployment variable snapshot under certain circumstances.
- CVE-2026-4881Medium
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.
Original NVD description (English source)
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.