CVE-2026-101169

Name of the Vulnerable Software and Affected Versions Octopus Server (affected versions not specified)

Description An authenticated user with permissions to edit an Environment or Project can provide specifically crafted JSON content for the object. This leads to insecure deserialization, which allows the user to execute arbitrary code within the Octopus Server process. Insecure deserialization occurs when untrusted data is used to abuse the logic of an application to execute unintended code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.