CVE-2022-2572: Octopus Server

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked.

Affected products

• Octopus Octopus Server: from 3.5, before 2022.1.3264 (fixed in 2022.1.3264); from 2022.2.6729, before 2022.2.8277 (fixed in 2022.2.8277); from 2022.3.348, before 2022.3.10586 (fixed in 2022.3.10586); from 2022.4.791, before 2022.4.2898 (fixed in 2022.4.2898)

Published 2022-11-01. Last modified 2026-06-17.