CVE-2022-1901: Octopus Server

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.

Affected products

• Octopus Octopus Server: from 2019.1.0, up to and including 2019.7.3; from 2020.1.0, up to and including 2020.6.5449; from 2021.1.6959, up to and including 2021.3.13021; from 2022.1.0, before 2022.1.3009 (fixed in 2022.1.3009); from 2022.2.6729, before 2022.2.7244 (fixed in 2022.2.7244); from 2022.3.348, before 2022.3.4953 (fixed in 2022.3.4953)

Published 2022-08-19. Last modified 2026-06-17.