Skip to content
OpenAdvisories
High 2 exploited CVEs WID-SEC-2026-2808 25 CVEs

JFrog Artifactory: Mehrere Schwachstellen

Published Aug 12, 2026 · Updated Sep 10, 2026 · Revision 3 · de-DE

Vendor: jfrog Product: artifactory

Summary

Ein Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um die Authentifizierung zu umgehen, Berechtigungen zu erweitern, sich als Benutzer auszugeben, vertrauliche Informationen offenzulegen oder geschützte Daten zu manipulieren.

Product

JFrog Artifactory ist eine universelle DevOps-Lösung.

Vulnerabilities 25

  • High 7.5
    CVE-2026-42018 Exploited Scanner template

    Anonymous user token generation exposure in JFrog Artifactory

    JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

    jfrog artifactory
    KEV Sep 11, 2026
  • Medium 5.3
    CVE-2026-66384 Exploited Public exploit

    Authenticated users may write data outside the intended Docker cache path

    An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

    jfrog artifactory
    KEV Aug 27, 2026
  • High 8.8
    CVE-2026-69106

    Potential cache poisoning in JFrog Artifactory

    A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.

    jfrog artifactory
  • High 8.1
    CVE-2026-66375

    Low-privilege users may remove protected Artifactory metadata

    A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.

    jfrog artifactory
  • High 8.1
    CVE-2026-69105

    Potential package cache integrity issue in JFrog Artifactory

    An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.

    jfrog artifactory
  • High 7.5
    CVE-2026-68757

    Potential improper SAML signature verification in JFrog Artifactory

    A user with access to a valid SAML response may impersonate another user under specific conditions.

    jfrog artifactory
  • High 7.2
    CVE-2026-68752

    Project Resource Managers may escalate privileges in JFrog Artifactory

    A Project Resource Manager may gain broader administrative privileges under specific conditions.

    jfrog artifactory
  • High 7.2
    CVE-2026-68759

    Integration credential holders may impersonate users in JFrog Access

    A holder of a valid integration credential may impersonate other users under specific conditions.

    jfrog artifactory
  • Medium 6.7
    CVE-2026-66016

    Rendered Artifactory Helm manifests may contain generated TLS private keys

    Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.

    jfrog artifactory
  • Medium 6.6
    CVE-2026-68756

    Potential insecure deserialization in JFrog Artifactory

    A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

    jfrog artifactory
  • Medium 6.5
    CVE-2026-68754

    Publishers without delete permission can overwrite docker layer information

    A repository publisher without delete permission may modify protected package content under specific conditions.

    jfrog artifactory
  • Medium 6.5
    CVE-2026-68758

    Authenticated users may access restricted Artifactory support information

    A low-privileged authenticated user may access restricted support information under specific conditions.

    jfrog artifactory
  • Medium 5.9
    CVE-2026-69107

    Potential unauthorized artifact access in JFrog Artifactory

    An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.

    jfrog artifactory
  • Medium 5.3
    CVE-2026-66377

    Anonymous users may access restricted Artifactory repository information

    An unauthenticated user may access restricted repository information under specific conditions.

    jfrog artifactory
  • Medium 5.3
    CVE-2026-66381

    Repository readers may access content outside configured upstream paths

    A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

    jfrog artifactory
  • Medium 5.3
    CVE-2026-68753

    Anonymous users may access restricted Artifactory content under specific configurations

    An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.

    jfrog artifactory
  • Medium 5.3
    CVE-2026-68760

    Potential remember-me authentication bypass in JFrog Artifactory

    An unauthenticated user may bypass authentication under specific cache conditions.

    jfrog artifactory
  • Medium 4.3
    CVE-2026-66378

    Authenticated users may access private NuGet metadata

    An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

    jfrog artifactory
  • Medium 4.3
    CVE-2026-66379

    Authenticated users may view private Puppet module metadata

    An authenticated user may view private Puppet module metadata without repository read access.

    jfrog artifactory puppet Ubuntu
  • Medium 4.3
    CVE-2026-66380

    Authenticated users may access private OCI referrer metadata

    An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

    jfrog artifactory
  • Medium 4.3
    CVE-2026-66382

    Authenticated users may write files outside the intended Artifactory work directory

    An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

    jfrog artifactory
  • Medium 4.3
    CVE-2026-68755

    Bundle writers may alter trusted release information in JFrog Artifactory

    A bundle writer may create misleading release promotion information under specific conditions.

    jfrog artifactory
  • Medium 4.3
    CVE-2026-70547

    Potential unauthorized metadata exposure in JFrog Artifactory

    An authenticated user without repository read permission may access package metadata under specific conditions.

    jfrog artifactory
  • Medium 4.2
    CVE-2026-66376

    Deleted users may temporarily retain access to JFrog Artifactory

    Credentials for a deleted user may remain valid for a short period under specific conditions.

    jfrog artifactory
  • Low 3.1
    CVE-2026-65926

    Private Release Bundle versions may be disclosed under specific configurations

    An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

    jfrog artifactory

Revision history

  1. #3

    Exploit aufgenommen CVE-2026-42016, CVE-2026-42018 und CVE-2026-82329

  2. #2

    CVE-2026-66384 wird ausgenutzt

  3. #1

    Initiale Fassung

References