Read the docs
TI-2025-00493 Aliases CVE-2025-0589GHSA-p76j-345f-qxpw

In affected versions of Octopus Deploy where customers are using Active Directory for…

Priority LOW 37CWE-648Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00373 31st percentileScored 2026-11-07
Fix Fixed Octopus Server (Octopus Deploy): 2024.3.13071, 2024.4.7065

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Octopus DeployOctopus Server2020.3.3 to before 2024.3.13071; 2024.4.401 to before 2024.4.70652024.3.13071, 2024.4.7065Patch availableCNA
  • Octopus Server VendorOctopus Deploy Affected 2020.3.3 to before 2024.3.13071; 2024.4.401 to before 2024.4.7065 Fixed in 2024.3.13071, 2024.4.7065 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*2020.3.3 to before 2024.3.13071; 2024.4.401 to before 2024.4.7065VulnerableOctopus Deploy
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:* Versions 2020.3.3 to before 2024.3.13071; 2024.4.401 to before 2024.4.7065 Vulnerable ·Octopus Deploy
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Octopus Server (Octopus Deploy) Fixed in 2024.3.13071, 2024.4.7065

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-0589
  2. 2026-10-03 Alias added: GHSA-p76j-345f-qxpw

References

Advisory 1

  • TI-2018-13353 In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with… CVSS 3.0HIGH 8.8
  • TI-2022-02375 Improper authentication in Octopus Server CVSS 3.1CRITICAL 9.8
  • TI-2022-02579 Insufficient session expiration in Octopus Server CVSS 3.1CRITICAL 9.1
  • TI-2018-08066 In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the… CVSS 3.0CRITICAL 9.8
  • TI-2022-02575 In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. CVSS 3.1CRITICAL 9.8
  • TI-2022-03678 In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation CVSS 3.1HIGH 8.8
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences