CVE-2026-14163 is a high severity information exposure flaw in Octopus Server. Under certain circumstances, sensitive variables can be printed in clear text in the deployment variable snapshot. Fixed releases are 2026.1.11587 and 2026.2.13190, and Octopus recommends the latest release, 2026.2.13344.
What's affected
- Per the Octopus advisory SA2026-07: all 3.x versions after 3.2.6, all 4.x, 2018.x through 2025.x, 2026.1.x before 2026.1.11587, and 2026.2.x before 2026.2.13190. The advisory lists one range as 2029.x, which looks like a typo for 2019.x, so check the advisory text.
- Fixed: 2026.1.11587 and 2026.2.13190. Versions 2026.2.13344 or higher are not affected.
- Mitigation: none known. Upgrading is the only remedy.
Source conflict on severity: the CVE record scores this 7.5 High (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The Octopus advisory header lists High with CVSS 7.1, but its severity section calls the issue medium. The advisory does not resolve the difference. All three figures are shown here.
How to check if you're exposed
Find your Octopus Server version in the web portal footer or the server's about page, or from the service on the host.
On Linux or container installs, check the image tag. Compare with the fixed releases above. Because the exposure is in stored deployment snapshots, also ask who can view deployment variable snapshots and where those are copied, for example into logs or tickets.
What to do now
- Confirm your Octopus Server version.
- Upgrade to 2026.1.11587, 2026.2.13190 or later, with 2026.2.13344 as the advisory's recommended release.
- Review who can view deployment variable snapshots.
- Rotate any secret that could have been exposed in a snapshot, starting with the most privileged.
Why it matters
The record classifies this as CWE-532 (Insertion of Sensitive Information into Log File). Sensitive variables, which should stay masked, were printed in clear text into a snapshot. The advisory describes it as occurring under certain circumstances and does not list the circumstances here.
Deployment tooling holds some of the most valuable secrets in a company: cloud keys, database passwords, signing material. A flaw that shows them in plain text turns anyone with snapshot access into a holder of those secrets. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog. After patching, secret rotation is the step teams skip.
Secrets handling is the real topic here. Even without this bug, deployment variables travel through many places: snapshots, logs, exports and backups. Use the patch as a prompt to check where sensitive variables are stored, who can read them, and how quickly you could rotate each one if needed.
Quick check
Does patching remove secrets already exposed?
No. Rotate secrets that may have appeared in snapshots.
Why are there two severity labels in the advisory?
The header says High with 7.1 and the severity section says medium. The advisory does not explain it.
Sources
Last reviewed: 18 October 2026.
