CVE-2026-3236
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding t…
Published Mar 5, 2026 · updated Jun 17, 2026 · octopus octopus server
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 5, 2026 · NIST NVD
Detected
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.
Jun 17, 2026 · NIST NVD
Updated
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.
Affected
- cpe octopus/octopus serverversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-3236
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-3236
In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token.
nvd.nist.gov