CVE-2026-3237

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3237", "assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", "state": "PUBLISHED", "assignerShortName": "Octopus", "dateReserved": "2026-02-26T00:26:01.068Z", "datePublished": "2026-03-17T06:37:59.369Z", "dateUpdated": "2026-03-17T13:20:24.029Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", "shortName": "Octopus", "dateUpdated": "2026-03-17T06:37:59.369Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Low-Privilege User Can Modify Global Signing Key Settings"}]}], "affected": [{"vendor": "Octopus Deploy", "product": "Octopus Server", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "2023.0.0", "lessThan": "2025.3.14731", "versionType": "custom"}, {"status": "affected", "version": "2025.4.0", "lessThan": "2025.4.10359", "versionType": "custom"}, {"status": "affected", "version": "2026.1.0", "lessThan": "2026.1.5571", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability."}]}], "references": [{"url": "https://advisories.octopus.com/post/2026/sa2026-03"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "This vulnerability was found by raihanadiarba", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "CWE-285 Improper Authorization"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T13:20:19.497726Z", "id": "CVE-2026-3237", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:20:24.029Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3237", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T13:20:19.497726Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:20:14.956Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "This vulnerability was found by raihanadiarba"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Octopus Deploy", "product": "Octopus Server", "versions": [{"status": "affected", "version": "2023.0.0", "lessThan": "2025.3.14731", "versionType": "custom"}, {"status": "affected", "version": "2025.4.0", "lessThan": "2025.4.10359", "versionType": "custom"}, {"status": "affected", "version": "2026.1.0", "lessThan": "2026.1.5571", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://advisories.octopus.com/post/2026/sa2026-03"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Low-Privilege User Can Modify Global Signing Key Settings"}]}], "providerMetadata": {"orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", "shortName": "Octopus", "dateUpdated": "2026-03-17T06:37:59.369Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3237", "state": "PUBLISHED", "dateUpdated": "2026-03-17T13:20:24.029Z", "dateReserved": "2026-02-26T00:26:01.068Z", "assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272", "datePublished": "2026-03-17T06:37:59.369Z", "assignerShortName": "Octopus"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Octopus Server", "vendor": "Octopus Deploy", "versions": [{"lessThan": "2025.3.14731", "status": "affected", "version": "2023.0.0", "versionType": "custom"}, {"lessThan": "2025.4.10359", "status": "affected", "version": "2025.4.0", "versionType": "custom"}, {"lessThan": "2026.1.5571", "status": "affected", "version": "2026.1.0", "versionType": "custom"}]}], "source": "security@octopus.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "33159148-02D1-4BF7-9757-9BE7EDE5812F", "versionEndExcluding": "2025.3.14731", "vulnerable": true}, {"criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "DDD68927-7049-4FF9-A9B1-EDEA0DF967B5", "versionEndExcluding": "2025.4.10359", "versionStartIncluding": "2025.4.51", "vulnerable": true}, {"criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B52D0F4C-0A73-4692-B1D7-3335509A2E93", "versionEndExcluding": "2026.1.5571", "versionStartIncluding": "2026.1.675", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability."}, {"lang": "es", "value": "En las versiones afectadas de Octopus Server era posible para un usuario con bajos privilegios manipular una solicitud de API para cambiar los plazos de caducidad y revocaci\u00f3n de la clave de firma a trav\u00e9s de un endpoint de API que ten\u00eda una validaci\u00f3n de permisos incorrecta. No era posible exponer las claves de firma utilizando esta vulnerabilidad."}], "id": "CVE-2026-3237", "lastModified": "2026-06-17T10:43:16.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@octopus.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3237", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T13:20:19.497726Z", "version": "2.0.3"}}]}, "published": "2026-03-17T07:16:03.610", "references": [{"source": "security@octopus.com", "tags": ["Vendor Advisory"], "url": "https://advisories.octopus.com/post/2026/sa2026-03"}], "sourceIdentifier": "security@octopus.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[2023.0.0,2025.3.14731)"}}, {"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[2025.4.0,2025.4.10359)"}}, {"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[2026.1.0,2026.1.5571)"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Octopus Server", "source": "cna", "vendor": "Octopus Deploy"}, "product": "octopus_server", "vendor": "octopus"}], "analysis": {"en": {"generated_at": "2026-04-07T10:23:01.023244+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011released patch or upgrade to a non\u2011vulnerable Octopus Server version.", "Verify that signing key expiration settings match the intended policy after remediation.", "Monitor API usage for anomalous changes to key expiration values.", "If a patch is not yet available, restrict the affected API endpoint to privileged users or temporarily disable it until a fix is applied."], "summary": {"action": "Apply Patch", "impact": "Alter Signing Key Expiration"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Octopus Deploy Octopus Server product. Specific version information is not provided in the CVE data; therefore it is unclear which releases contain the issue. Administrators should consult the vendor advisory or support resources to determine whether their server instance is affected.", "description_and_impact": "Octopus Deploy\u2019s Octopus Server contains a flaw in an API endpoint that incorrectly validates permissions. An authenticated user with low privileges can send a crafted request to change the expiration and revocation dates of signing keys used by the system. This does not expose the signing keys themselves, but it allows the attacker to shorten or extend the valid life of those keys, potentially disrupting the integrity of secure communications within the deployment environment.", "risk_and_exploitability": "The CVSS score of 2.3 indicates a low severity impact. The EPSS score of less than 1% suggests that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the API, so the attack vector is likely limited to users with API privileges. Even though the risk is reduced compared to more severe weaknesses, the ability to manipulate key lifetimes can undermine the trust model of the deployment pipeline and should be addressed promptly."}}}}, "created": "2026-03-17T09:51:54.544752+00:00", "updated": "2026-04-08T20:01:32.274398+00:00", "vendors": ["octopus", "octopus$PRODUCT$octopus_server"]}