Octopus Server Updates Restrict LDAP Directory Searches
Tech GuruQuick Answer
Octopus advisory SA2026-18 affects self-hosted servers with LDAP authentication. Inventory versions and LDAP use, update to 2026.2.13487 or 2026.3.15909, validate login and directory integration, review unusual searches where warranted, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory self-hosted Octopus Servers, exact branches and builds, LDAP authentication and directory scope, authenticated users, internet exposure, owners, audit logs, backups, and maintenance windows. Confirm that LDAP authentication is enabled on a self-hosted affected release; do not infer exposure for Octopus Cloud or servers without the LDAP provider. Upgrade the maintained branch to Octopus Server 2026.2.13487 or 2026.3.15909, or a later supported fixed release, and restrict unnecessary authenticated access while rollout is pending. Confirm the running build, test LDAP login, group mapping, user administration and deployments, review audit and directory logs for unusual searches where warranted, and retain package and change evidence.
Last verified: 2026-10-29 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Octopus Server with the LDAP authentication provider enabled |
|---|---|
| Advisory | SA2026-18 |
| CVE | CVE-2026-118426 |
| Authoritative release date | 2026-10-29 02:02:13.443 UTC |
| Authority revision date | 2026-10-29 02:02:13.443 UTC |
| Affected versions | Octopus Server 3.x through 2026.1, 2026.2 before 2026.2.13487, and 2026.3 before 2026.3.15909 when LDAP authentication is enabled; Octopus Cloud is already updated. |
| Fixed version | Octopus Server 2026.2.13487 or 2026.3.15909; later supported releases are unaffected |
| CVSS base score | 5.3 (CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | Octopus Deploy does not state that this vulnerability is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Octopus fixed missing authorization that allowed any authenticated user to call LDAP user and group search when the LDAP authentication provider was enabled.
What To Validate Now
- Inventory. Inventory self-hosted Octopus Servers, exact branches and builds, LDAP authentication and directory scope, authenticated users, internet exposure, owners, audit logs, backups, and maintenance windows.
- Establish applicability. Confirm that LDAP authentication is enabled on a self-hosted affected release; do not infer exposure for Octopus Cloud or servers without the LDAP provider.
- Remediate. Upgrade the maintained branch to Octopus Server 2026.2.13487 or 2026.3.15909, or a later supported fixed release, and restrict unnecessary authenticated access while rollout is pending.
- Validate. Confirm the running build, test LDAP login, group mapping, user administration and deployments, review audit and directory logs for unusual searches where warranted, and retain package and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
LDAP search results can expose directory structure and account data. Coordinate the server update with authentication owners and preserve audit evidence before changing directory integrations when suspicious access is found.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
