CVE-2022-2528: Octopus Server

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.

Affected products

• Octopus Octopus Server: from 3.0.0, up to and including 4.1.10; from 2018.1.0, up to and including 2021.3.13021; from 2022.1.0, before 2022.1.3106 (fixed in 2022.1.3106); from 2022.2.6729, before 2022.2.7718 (fixed in 2022.2.7718); from 2022.3.348, before 2022.3.7782 (fixed in 2022.3.7782)

Published 2022-09-09. Last modified 2026-06-17.