CVE-2026-116835
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 12, 2026
Vendor
unknown
Description
In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity.