CVE-2026-3236 | Octopus Deploy Octopus Server up to 2025.3.14760/2025.4.10408 New API Key authorization

A vulnerability classified as critical has been found in Octopus Deploy Octopus Server up to 2025.3.14760/2025.4.10408. Affected by this vulnerability is an unknown functionality of the component New API Key Handler. Performing a manipulation results in incorrect authorization.

This vulnerability was named CVE-2026-3236. The attack may be initiated remotely. There is no available exploit.

It is recommended to upgrade the affected component.