JFrog Artifactory: 17 Vulnerabilities Disclosed, Highlighting Access Control and Metadata Risks
Key findings • 17 vulnerabilities disclosed in JFrog Artifactory on August 12, 2026, ranging from Medium to High severity. • Several high-severity flaws allow unauthorized access to metadata,…
Key findings
- 17 vulnerabilities disclosed in JFrog Artifactory on August 12, 2026, ranging from Medium to High severity.
- Several high-severity flaws allow unauthorized access to metadata, caching of untrusted content, and potential user impersonation.
- Issues include improper access controls, metadata poisoning, and exposure of sensitive information.
- JFrog has released patches; users should update to secure versions.
- The batch highlights risks in Artifactory's handling of authentication, authorization, and caching.
On August 12, 2026, JFrog disclosed a batch of 17 vulnerabilities affecting its Artifactory software. These vulnerabilities, disclosed within a three-hour window, range in severity from Medium to High, with several allowing for unauthorized access to sensitive metadata and artifacts, or the potential to poison cached content. The disclosures highlight a recurring theme of insufficient access controls and improper handling of metadata across various Artifactory components.
Several high-severity vulnerabilities center on the potential for unauthorized access and manipulation of artifact metadata. CVE-2026-69106 (CVSSv3 8.8) allows a low-privileged user to poison cached artifact metadata, potentially leading consumers to retrieve untrusted content. Similarly, CVE-2026-69105 (CVSSv3 8.1) enables an unauthenticated attacker to cause untrusted package content to be cached, impacting artifact integrity and availability. Another critical issue, CVE-2026-42018 (CVSSv3 7.5), could return an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, potentially exposing sensitive resources. Furthermore, CVE-2026-68759 (CVSSv3 7.2) permits a user with valid integration credentials to impersonate other users, and CVE-2026-68752 (CVSSv3 7.2) could allow a Project Resource Manager to gain broader administrative privileges. Finally, CVE-2026-66375 (CVSSv3 8.1) enables a low-privilege authenticated user to permanently remove protected internal metadata across repositories.
Other vulnerabilities focus on unauthorized access to package metadata and restricted artifacts. CVE-2026-69107 (CVSSv3 5.9) allows an unauthenticated user to access restricted artifacts. Multiple medium-severity CVEs, including CVE-2026-70547 (CVSSv3 4.3), CVE-2026-66380 (CVSSv3 4.3), and CVE-2026-66378 (CVSSv3 4.3), involve authenticated users without proper read permissions accessing private metadata. CVE-2026-66379 (CVSSv3 4.3) and CVE-2026-66382 (CVSSv3 4.3) also detail authenticated users writing files or accessing metadata outside intended directories or without necessary permissions. CVE-2026-66384 (CVSSv3 5.3) describes an authenticated user writing data outside the intended Docker cache path. CVE-2026-68753 (CVSSv3 5.3) allows unauthenticated access to restricted content under specific remote repository configurations. Additionally, CVE-2026-68754 (CVSSv3 6.5) permits a repository publisher without delete permission to modify protected package content, and CVE-2026-68756 (CVSSv3 6.6) allows a party with write access to session data to affect Artifactory. CVE-2026-66016 (CVSSv3 6.7) involves potential retention of TLS private keys in self-hosted Helm configurations.
JFrog has addressed these vulnerabilities through updates to Artifactory. Users are advised to consult JFrog's security advisories for specific version information and recommended upgrade paths. The coordinated disclosure of these numerous vulnerabilities underscores the importance of regular security patching and diligent access control management for Artifactory instances.
This batch of vulnerabilities highlights potential weaknesses in how Artifactory handles authentication, authorization, and metadata caching. Users should prioritize updating their Artifactory instances to the latest patched versions to mitigate the risks associated with these issues. Continuous monitoring and adherence to JFrog's security best practices are crucial for maintaining the integrity and security of artifact repositories.