medium4.3
CVE-2026-3236
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exc…
Impact
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octopus | Octopus Server | from 2023.1.4189 before 2025.3.14761 from 2025.4.51 before 2025.4.10409 |