Skip to content
OpenAdvisories
High 1 exploited CVE WID-SEC-2026-2548 13 CVEs

JFrog Artifactory: Mehrere Schwachstellen

Published Jul 27, 2026 · Updated Sep 13, 2026 · Revision 2 · de-DE

Vendor: jfrog Product: artifactory Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.

Product

JFrog Artifactory ist eine universelle DevOps-Lösung.

Vulnerabilities 13

  • High 8.1
    CVE-2026-42016 Exploited Public exploit Scanner template

    Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

    JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

    jfrog artifactory
    KEV Sep 11, 2026
  • High 8.8
    CVE-2026-42017

    Privilege escalation via JFrog Worker event token exposure

    An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions.

    jfrog artifactory
  • High 8.8
    CVE-2026-65616 Public exploit

    Potential privilege escalation to JFrog administrator privileges

    Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

    jfrog artifactory
  • High 8.8
    CVE-2026-65617

    Potential remote code execution on an Artifactory package service container.

    A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

    jfrog artifactory
  • High 8.8
    CVE-2026-65921

    Potential path traversal leading to unauthorized file writes

    A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.

    jfrog artifactory
  • High 8.8
    CVE-2026-66014

    Potential authentication bypass leading to privilege escalation in Artifactory

    JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.

    jfrog artifactory
  • High 7.2
    CVE-2026-66015

    JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.

    An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access.

    jfrog artifactory
  • High 7.1
    CVE-2026-65922

    Potential unauthorized modification of Artifactory internal metadata

    An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability imp…

    jfrog artifactory
  • Medium 6.8
    CVE-2026-65923

    Potential server-side request forgery in Artifactory Ansible repository handling

    A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addres…

    jfrog artifactory
  • Medium 6.5
    CVE-2026-65618

    Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability

    Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

    jfrog artifactory
  • Medium 6.5
    CVE-2026-65924

    Server-Side Request Forgery (SSRF) via Terraform Remote repository

    JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to i…

    jfrog artifactory
  • Medium 6.5
    CVE-2026-65925

    Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

    A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

    jfrog artifactory
  • Medium 6.5
    CVE-2026-66018

    JFrog Artifactory build environment properties exposure

    Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secr…

    jfrog artifactory

Revision history

  1. #2

    Aktive Ausnutzung gemeldet

  2. #1

    Initiale Fassung

References