CVE-2017-17665: Octopus Deploy

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.

Affected products

• Octopus Octopus Deploy: before 4.1.3 (fixed in 4.1.3)

Published 2017-12-13. Last modified 2026-06-17.