CVE-2021-31817: Octopus Server

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.

Affected products

• Octopus Server: from 2020.6.0, before 2020.6.5146 (fixed in 2020.6.5146); from 2021.1.0, before 2021.1.7316 (fixed in 2021.1.7316)

Published 2021-07-08. Last modified 2026-06-17.