Technical impact
In affected releases of Octopus Deploy Server, a flaw can lead to the printing of sensitive variables in clear text within a deployment variable snapshot. The vulnerability exposes confidential configuration data to anyone who can view snapshots, potentially revealing passwords, API keys, or other secrets. This flaw is classified as an information disclosure (CWE‑532).
Affected Systems
The issue impacts Octopus Deploy Server. Exact affected version ranges are not disclosed in the advisory, so all installations of Octopus Deploy Server at the time of the advisory should be considered vulnerable until an official fix is applied.
Risk and Exploitability
The CVSS score is 7.1, indicating a high severity level. Exploitability is low, with an EPSS score of less than 1 % and no listing in the CISA KEV catalog. The likely attack vector is through access to deployment snapshots or via APIs that expose snapshot data, which typically requires a user with read permissions to deployments. Because secrets can be disclosed directly, high impact is possible for the user or team having snapshot view rights. No public exploit has been reported, but the vulnerability should be remediated promptly.
