Cleartext storage of sensitive information in OctopusDeploy OctopusDSC
Priority LOW 27CWE-319Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.
Summary
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.
Why it matters now
EPSS 0.00279 20th percentileScored 2026-11-07
Fix Fixed OctopusDSC (OctopusDeploy): 4.0.1002
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OctopusDeploy | OctopusDSC | before 4.0.1002 | 4.0.1002 | Patch available | CNA |
- OctopusDSC VendorOctopusDeploy Affected before 4.0.1002 Fixed in 4.0.1002 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:octopus:octopusdsc:*:*:*:*:*:*:*:* | before 4.0.1002 | Vulnerable | Octopus Deploy |
- cpe:2.3:a:octopus:octopusdsc:*:*:*:*:*:*:*:* Versions before 4.0.1002 Vulnerable ·Octopus Deploy
Remediation
- Fix · CNA OctopusDSC (OctopusDeploy) Fixed in 4.0.1002
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21270
References
Patch 2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences