CVE-2026-14163CWE-532

CVE-2026-14163

High · published August 20, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-08-20T11:16Z
Affected products (2)
ProductVersionsFixed in
octopus/octopus_server≥ 3.2.7, < 2026.1.115872026.1.11587
octopus/octopus_server≥ 2026.2.61, < 2026.2.131902026.2.13190
References (1)
https://advisories.octopus.com/post/2026/sa2026-07/ · [email protected]
EPSS history
Timeline
  • 20 AUG 06:48Z
    In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in…
    cvelistv5