CVE-2026-117341

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.

• CWE-532

• https://advisories.octopus.com/post/2026/sa2026-16

Published

Oct 27, 2026

Last Modified

Oct 27, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1173A vulnerability was found in birkir prime up to 0.4.0.beta.0…9.8
• CVE-2026-11730Insufficient session randomness vulnerability in the listed …5.4
• CVE-2026-11731An authentication bypass vulnerability in the listed NETGEAR…8.8
• CVE-2026-11732An insufficient input validation vulnerability in the websit…8.8
• CVE-2026-11733A buffer overflow vulnerability in the listed NETGEAR models…4.9
• CVE-2026-11734A buffer overflow vulnerability in the listed NETGEAR models…2.7
• CVE-2026-11735A stack-based buffer overflow vulnerability affects the list…4.9
• CVE-2026-11736A stack-based buffer overflow vulnerability affects certain …4.9
• CVE-2026-11737Insufficient input validation vulnerability in the listed N…4.5
• CVE-2026-11738Insufficient input validation vulnerability in the listed NE…4.4
• CVE-2026-11739A command injection vulnerability in certain affected NETGEA…6.4
• CVE-2026-1174A vulnerability was determined in birkir prime up to 0.4.0.b…7.5