This vulnerability affects Octopus Server in specific versions (3.2.6 and 2026.2.61). Under certain circumstances, sensitive variables are included in the deployment variable snapshot JSON in clear-text, potentially exposing confidential data. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, high vulnerability confidentiality impact, and no impact on integrity or availability. The vendor has not yet provided an official fix or remediation level.

Sensitive variables intended to be protected may be exposed in clear-text, potentially leading to unauthorized disclosure of confidential information. This could compromise the confidentiality of deployment secrets or credentials managed by Octopus Server. There is no indication of impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to deployment variable snapshots and restrict permissions to trusted users only to reduce exposure risk.