Vendor
jfrog
65 known vulnerabilities.
Products
21 results · Clear filters · Feed
-
High 7.6
Potential unauthorized repository migration in JFrog Artifactory
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.
-
High 8.5
Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.
-
High 8.8
Potential cache poisoning in JFrog Artifactory
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
-
High 7.5CVE-2026-42018 Exploited
Anonymous user token generation exposure in JFrog Artifactory
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
KEV Sep 11, 2026 -
High 8.1
Potential package cache integrity issue in JFrog Artifactory
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
-
High 7.2
Integration credential holders may impersonate users in JFrog Access
A holder of a valid integration credential may impersonate other users under specific conditions.
-
High 8.1
Low-privilege users may remove protected Artifactory metadata
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
-
High 7.5
Potential improper SAML signature verification in JFrog Artifactory
A user with access to a valid SAML response may impersonate another user under specific conditions.
-
High 7.2
Project Resource Managers may escalate privileges in JFrog Artifactory
A Project Resource Manager may gain broader administrative privileges under specific conditions.
-
High 7.1
Potential unauthorized modification of Artifactory internal metadata
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability imp…
-
High 8.8
Potential remote code execution on an Artifactory package service container.
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.
-
High 8.8CVE-2026-65616 Public exploit
Potential privilege escalation to JFrog administrator privileges
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.
-
High 7.2
JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.
An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access.
-
High 8.8
Potential authentication bypass leading to privilege escalation in Artifactory
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
-
High 8.8
Potential path traversal leading to unauthorized file writes
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.
-
High 8.8
Privilege escalation via JFrog Worker event token exposure
An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions.
-
High 8.1
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
KEV Sep 11, 2026 -
High 8.8
JFrog Artifactory Cross-Site Scripting
JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism.
-
High 7.2
JFrog Artifactory Improper input validation leads to arbitrary file write
JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validat…
-
High 8.8
JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead…
-
High 8.8
JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privilege…