VYPR
Unrated severityNVD Advisory· Published Jul 27, 2026· Updated Jul 27, 2026

JFrog Artifactory build environment properties exposure

CVE-2026-66018

Description

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets (confidentiality impact; no integrity or availability impact demonstrated).

Affected products

1

Patches

Vulnerability mechanics

References

2

News mentions

6