CVE-2022-23184: Octopus Deploy

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects.

Affected products

• Octopus Octopus Deploy: from 0.9, up to and including 4.1.10; from 2018.1.0, up to and including 2020.1.1
• Octopus Octopus Server: from 2021.2.0, before 2021.2.8011 (fixed in 2021.2.8011); from 2021.3.0, before 2021.3.11057 (fixed in 2021.3.11057)

Published 2022-02-07. Last modified 2026-06-17.