Refine your search
64 vulnerabilities found for by jfrog
CVE-2026-82329 (GCVE-0-2026-82329)
Vulnerability from cvelistv5
Published
2026-08-28 18:27
Modified
2026-08-28 18:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication
Summary
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.111.21 Version: 7.117.0 < 7.117.28 Version: 7.125.0 < 7.125.20 Version: 7.133.0 < 7.133.29 Version: 7.146.0 < 7.146.38 Version: 7.161.0 < 7.161.20 |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.111.21",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.117.28",
"status": "affected",
"version": "7.117.0",
"versionType": "custom"
},
{
"lessThan": "7.125.20",
"status": "affected",
"version": "7.125.0",
"versionType": "custom"
},
{
"lessThan": "7.133.29",
"status": "affected",
"version": "7.133.0",
"versionType": "custom"
},
{
"lessThan": "7.146.38",
"status": "affected",
"version": "7.146.0",
"versionType": "custom"
},
{
"lessThan": "7.161.20",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eJFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.\u003c/p\u003e"
}
],
"value": "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:27:43.632Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Potential authentication bypass leading to administrative access in Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-82329",
"datePublished": "2026-08-28T18:27:43.632Z",
"dateReserved": "2026-08-28T14:26:47.580Z",
"dateUpdated": "2026-08-28T18:27:43.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70550 (GCVE-0-2026-70550)
Vulnerability from cvelistv5
Published
2026-08-25 15:22
Modified
2026-08-26 19:47
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 7.161.0 < 7.161.19 Version: 7.146.0 < 7.146.29 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:34:53.953467Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:47:11.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.161.19",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
},
{
"lessThan": "7.146.29",
"status": "affected",
"version": "7.146.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.\u003c/p\u003e"
}
],
"value": "An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:22:53.484Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Potential unauthorized access to private Composer repository metadata in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-70550",
"datePublished": "2026-08-25T15:22:53.484Z",
"dateReserved": "2026-08-04T18:29:25.512Z",
"dateUpdated": "2026-08-26T19:47:11.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70548 (GCVE-0-2026-70548)
Vulnerability from cvelistv5
Published
2026-08-25 15:17
Modified
2026-08-26 19:47
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-918 - Server-Side request forgery (SSRF)
Summary
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 7.161.11 < 7.161.19 Version: 7.146.0 < 7.146.36 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70548",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:35:03.613732Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:47:26.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.161.19",
"status": "affected",
"version": "7.161.11",
"versionType": "custom"
},
{
"lessThan": "7.146.36",
"status": "affected",
"version": "7.146.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kostya Kortchinsky | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUnder specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.\u003c/p\u003e"
}
],
"value": "Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:17:16.973Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SSRF In CocoaPods Via JFrog Artifactory External Dependency"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-70548",
"datePublished": "2026-08-25T15:17:16.973Z",
"dateReserved": "2026-08-04T18:29:25.512Z",
"dateUpdated": "2026-08-26T19:47:26.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69104 (GCVE-0-2026-69104)
Vulnerability from cvelistv5
Published
2026-08-25 15:09
Modified
2026-08-25 17:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 7.161.0 < 7.161.19 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69104",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:33:15.055078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T17:43:24.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.161.19",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kostya Kortchinsky | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.\u003c/p\u003e"
}
],
"value": "An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:09:29.369Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Potential unauthorized repository migration in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-69104",
"datePublished": "2026-08-25T15:09:29.369Z",
"dateReserved": "2026-08-03T10:58:15.518Z",
"dateUpdated": "2026-08-25T17:43:24.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70551 (GCVE-0-2026-70551)
Vulnerability from cvelistv5
Published
2026-08-25 15:06
Modified
2026-08-26 19:47
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-918 - Server-Side request forgery (SSRF)
Summary
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 7.161.0 < 7.161.19 Version: 7.146.0 < 7.146.36 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70551",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:35:12.517022Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:47:41.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.161.19",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
},
{
"lessThan": "7.146.36",
"status": "affected",
"version": "7.146.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kostya Kortchinsky | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.\u003c/p\u003e"
}
],
"value": "A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:06:48.188Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Server-Side Request Forgery Via VCS remote download in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-70551",
"datePublished": "2026-08-25T15:06:48.188Z",
"dateReserved": "2026-08-04T18:29:25.512Z",
"dateUpdated": "2026-08-26T19:47:41.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69106 (GCVE-0-2026-69106)
Vulnerability from cvelistv5
Published
2026-08-12 17:48
Modified
2026-08-13 15:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Improper Input Validation
Summary
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.28 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:04:07.356444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:04:49.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.28",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Uri Katz | Oligo Security"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.\u003c/p\u003e"
}
],
"value": "A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T04:16:50.900Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Potential cache poisoning in JFrog Artifactory",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-69106",
"datePublished": "2026-08-12T17:48:29.429Z",
"dateReserved": "2026-08-03T10:58:15.519Z",
"dateUpdated": "2026-08-13T15:04:49.658Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42018 (GCVE-0-2026-42018)
Vulnerability from cvelistv5
Published
2026-08-12 17:43
Modified
2026-08-18 18:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication
Summary
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.111.20 Version: 7.117.0 < 7.117.27 Version: 7.125.0 < 7.125.19 Version: 7.133.0 < 7.133.28 Version: 7.146.0 < 7.146.8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:05:05.752699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:08:16.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.111.20",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.117.27",
"status": "affected",
"version": "7.117.0",
"versionType": "custom"
},
{
"lessThan": "7.125.19",
"status": "affected",
"version": "7.125.0",
"versionType": "custom"
},
{
"lessThan": "7.133.28",
"status": "affected",
"version": "7.133.0",
"versionType": "custom"
},
{
"lessThan": "7.146.8",
"status": "affected",
"version": "7.146.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniil Vylegzhanin (NetSPI)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eJFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.\u003c/p\u003e"
}
],
"value": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:14:10.646Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Anonymous user token generation exposure in JFrog Artifactory",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-42018",
"datePublished": "2026-08-12T17:43:21.289Z",
"dateReserved": "2026-04-23T13:41:13.755Z",
"dateUpdated": "2026-08-18T18:14:10.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69107 (GCVE-0-2026-69107)
Vulnerability from cvelistv5
Published
2026-08-12 15:51
Modified
2026-08-12 18:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.104.16 Version: 7.111.0 < 7.111.14 Version: 7.117.0 < 7.117.21 Version: 7.125.0 < 7.125.14 Version: 7.133.0 < 7.133.21 Version: 7.146.0 < 7.146.8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69107",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:14:51.166880Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:15:09.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.104.16",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.111.14",
"status": "affected",
"version": "7.111.0",
"versionType": "custom"
},
{
"lessThan": "7.117.21",
"status": "affected",
"version": "7.117.0",
"versionType": "custom"
},
{
"lessThan": "7.125.14",
"status": "affected",
"version": "7.125.0",
"versionType": "custom"
},
{
"lessThan": "7.133.21",
"status": "affected",
"version": "7.133.0",
"versionType": "custom"
},
{
"lessThan": "7.146.8",
"status": "affected",
"version": "7.146.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniil Vylegzhanin (NetSPI)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.\u003c/p\u003e"
}
],
"value": "An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:51:47.747Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Potential unauthorized artifact access in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-69107",
"datePublished": "2026-08-12T15:51:47.747Z",
"dateReserved": "2026-08-03T10:58:15.519Z",
"dateUpdated": "2026-08-12T18:15:09.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69105 (GCVE-0-2026-69105)
Vulnerability from cvelistv5
Published
2026-08-12 15:19
Modified
2026-08-13 15:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Summary
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69105",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:19:56.198804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:20:10.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kostya Kortchinsky | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability. \u003c/p\u003e"
}
],
"value": "An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:19:40.055Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Potential package cache integrity issue in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-69105",
"datePublished": "2026-08-12T15:19:40.055Z",
"dateReserved": "2026-08-03T10:58:15.518Z",
"dateUpdated": "2026-08-13T15:20:10.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70547 (GCVE-0-2026-70547)
Vulnerability from cvelistv5
Published
2026-08-12 15:18
Modified
2026-08-13 15:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An authenticated user without repository read permission may access package metadata under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70547",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:18:41.256045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:18:53.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kostya Kortchinsky | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated user without repository read permission may access package metadata under specific conditions.\u003c/p\u003e"
}
],
"value": "An authenticated user without repository read permission may access package metadata under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:18:29.120Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Potential unauthorized metadata exposure in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-70547",
"datePublished": "2026-08-12T15:18:29.120Z",
"dateReserved": "2026-08-04T18:29:25.512Z",
"dateUpdated": "2026-08-13T15:18:53.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66016 (GCVE-0-2026-66016)
Vulnerability from cvelistv5
Published
2026-08-12 15:16
Modified
2026-08-12 18:40
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-312 - Cleartext Storage of Sensitive Information
Summary
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66016",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:39:25.421312Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:40:04.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthew Bryant | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUnder specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.\u003c/p\u003e"
}
],
"value": "Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312 Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:16:39.640Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Rendered Artifactory Helm manifests may contain generated TLS private keys"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66016",
"datePublished": "2026-08-12T15:16:39.640Z",
"dateReserved": "2026-07-23T19:59:51.588Z",
"dateUpdated": "2026-08-12T18:40:04.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68759 (GCVE-0-2026-68759)
Vulnerability from cvelistv5
Published
2026-08-12 15:15
Modified
2026-08-12 18:40
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Summary
A holder of a valid integration credential may impersonate other users under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68759",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:40:42.451663Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:40:52.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA holder of a valid integration credential may impersonate other users under specific conditions.\u003c/p\u003e"
}
],
"value": "A holder of a valid integration credential may impersonate other users under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:15:50.507Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Integration credential holders may impersonate users in JFrog Access"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-68759",
"datePublished": "2026-08-12T15:15:50.507Z",
"dateReserved": "2026-07-31T13:38:38.864Z",
"dateUpdated": "2026-08-12T18:40:52.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65926 (GCVE-0-2026-65926)
Vulnerability from cvelistv5
Published
2026-08-12 15:14
Modified
2026-08-12 18:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65926",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:41:44.422900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:41:54.602Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.\u003c/p\u003e"
}
],
"value": "An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:14:42.857Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Private Release Bundle versions may be disclosed under specific configurations"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-65926",
"datePublished": "2026-08-12T15:14:42.857Z",
"dateReserved": "2026-07-23T13:34:38.372Z",
"dateUpdated": "2026-08-12T18:41:54.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66384 (GCVE-0-2026-66384)
Vulnerability from cvelistv5
Published
2026-08-12 15:14
Modified
2026-08-28 03:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Summary
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66384",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-08-27",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T03:55:24.229Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://openai.com/index/hugging-face-incident-and-the-road-ahead/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-27T00:00:00.000Z",
"value": "CVE-2026-66384 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kostya Kortchinsky | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.\u003c/p\u003e"
}
],
"value": "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:14:04.906Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Authenticated users may write data outside the intended Docker cache path"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66384",
"datePublished": "2026-08-12T15:14:04.906Z",
"dateReserved": "2026-07-25T11:29:31.974Z",
"dateUpdated": "2026-08-28T03:55:24.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68758 (GCVE-0-2026-68758)
Vulnerability from cvelistv5
Published
2026-08-12 15:12
Modified
2026-08-12 18:42
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
A low-privileged authenticated user may access restricted support information under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:42:32.824456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:42:43.960Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA low-privileged authenticated user may access restricted support information under specific conditions.\u003c/p\u003e"
}
],
"value": "A low-privileged authenticated user may access restricted support information under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:12:56.567Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Authenticated users may access restricted Artifactory support information"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-68758",
"datePublished": "2026-08-12T15:12:56.567Z",
"dateReserved": "2026-07-31T13:38:38.864Z",
"dateUpdated": "2026-08-12T18:42:43.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66375 (GCVE-0-2026-66375)
Vulnerability from cvelistv5
Published
2026-08-12 15:11
Modified
2026-08-12 18:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:44:25.246814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:46:03.918Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.\u003c/p\u003e"
}
],
"value": "A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:11:35.807Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Low-privilege users may remove protected Artifactory metadata"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66375",
"datePublished": "2026-08-12T15:11:35.807Z",
"dateReserved": "2026-07-25T11:29:31.974Z",
"dateUpdated": "2026-08-12T18:46:03.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68757 (GCVE-0-2026-68757)
Vulnerability from cvelistv5
Published
2026-08-12 15:10
Modified
2026-08-12 19:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Summary
A user with access to a valid SAML response may impersonate another user under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68757",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T19:01:24.122109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T19:01:38.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ben Morris in collaboration with Claude and Anthropic Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user with access to a valid SAML response may impersonate another user under specific conditions.\u003c/p\u003e"
}
],
"value": "A user with access to a valid SAML response may impersonate another user under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:10:23.037Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Potential improper SAML signature verification in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-68757",
"datePublished": "2026-08-12T15:10:23.037Z",
"dateReserved": "2026-07-31T13:38:38.864Z",
"dateUpdated": "2026-08-12T19:01:38.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68756 (GCVE-0-2026-68756)
Vulnerability from cvelistv5
Published
2026-08-12 15:09
Modified
2026-08-13 03:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-502 - Deserialization of Untrusted Data
Summary
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T03:55:44.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ben Morris in collaboration with Claude and Anthropic Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA party with write access to stored session data may affect JFrog Artifactory under specific conditions.\u003c/p\u003e"
}
],
"value": "A party with write access to stored session data may affect JFrog Artifactory under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:09:21.899Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Potential insecure deserialization in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-68756",
"datePublished": "2026-08-12T15:09:21.899Z",
"dateReserved": "2026-07-31T13:38:38.864Z",
"dateUpdated": "2026-08-13T03:55:44.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66382 (GCVE-0-2026-66382)
Vulnerability from cvelistv5
Published
2026-08-12 15:08
Modified
2026-08-12 18:44
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Summary
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:43:50.405060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:44:03.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated user may write files outside the intended Artifactory work directory under specific conditions.\u003c/p\u003e"
}
],
"value": "An authenticated user may write files outside the intended Artifactory work directory under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:08:11.257Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Authenticated users may write files outside the intended Artifactory work directory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66382",
"datePublished": "2026-08-12T15:08:11.257Z",
"dateReserved": "2026-07-25T11:29:31.974Z",
"dateUpdated": "2026-08-12T18:44:03.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66381 (GCVE-0-2026-66381)
Vulnerability from cvelistv5
Published
2026-08-12 15:07
Modified
2026-08-12 18:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Summary
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66381",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:42:59.383185Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:43:38.116Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.\u003c/p\u003e"
}
],
"value": "A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:07:01.937Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Repository readers may access content outside configured upstream paths"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66381",
"datePublished": "2026-08-12T15:07:01.937Z",
"dateReserved": "2026-07-25T11:29:31.974Z",
"dateUpdated": "2026-08-12T18:43:38.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68760 (GCVE-0-2026-68760)
Vulnerability from cvelistv5
Published
2026-08-12 15:04
Modified
2026-08-12 18:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication
Summary
An unauthenticated user may bypass authentication under specific cache conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68760",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:41:19.825426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:41:33.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ben Morris in collaboration with Claude and Anthropic Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated user may bypass authentication under specific cache conditions.\u003c/p\u003e"
}
],
"value": "An unauthenticated user may bypass authentication under specific cache conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:04:59.156Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Potential remember-me authentication bypass in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-68760",
"datePublished": "2026-08-12T15:04:59.156Z",
"dateReserved": "2026-07-31T13:38:38.864Z",
"dateUpdated": "2026-08-12T18:41:33.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66379 (GCVE-0-2026-66379)
Vulnerability from cvelistv5
Published
2026-08-12 15:03
Modified
2026-08-13 15:16
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An authenticated user may view private Puppet module metadata without repository read access.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:16:13.465489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:16:44.396Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated user may view private Puppet module metadata without repository read access.\u003c/p\u003e"
}
],
"value": "An authenticated user may view private Puppet module metadata without repository read access."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:03:03.158Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Authenticated users may view private Puppet module metadata"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66379",
"datePublished": "2026-08-12T15:03:03.158Z",
"dateReserved": "2026-07-25T11:29:31.974Z",
"dateUpdated": "2026-08-13T15:16:44.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66378 (GCVE-0-2026-66378)
Vulnerability from cvelistv5
Published
2026-08-12 15:02
Modified
2026-08-13 15:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:15:03.696558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:15:33.552Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated user without repository read permission may access private NuGet metadata under specific conditions.\u003c/p\u003e"
}
],
"value": "An authenticated user without repository read permission may access private NuGet metadata under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:02:08.515Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Authenticated users may access private NuGet metadata"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66378",
"datePublished": "2026-08-12T15:02:08.515Z",
"dateReserved": "2026-07-25T11:29:31.974Z",
"dateUpdated": "2026-08-13T15:15:33.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66377 (GCVE-0-2026-66377)
Vulnerability from cvelistv5
Published
2026-08-12 15:00
Modified
2026-08-13 15:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An unauthenticated user may access restricted repository information under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:13:53.223963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:14:05.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated user may access restricted repository information under specific conditions.\u003c/p\u003e"
}
],
"value": "An unauthenticated user may access restricted repository information under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:00:49.800Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Anonymous users may access restricted Artifactory repository information"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66377",
"datePublished": "2026-08-12T15:00:49.800Z",
"dateReserved": "2026-07-25T11:29:31.974Z",
"dateUpdated": "2026-08-13T15:14:05.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68755 (GCVE-0-2026-68755)
Vulnerability from cvelistv5
Published
2026-08-12 15:00
Modified
2026-08-12 16:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-863 - Incorrect Authorization
Summary
A bundle writer may create misleading release promotion information under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T16:11:32.254653Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T16:11:43.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA bundle writer may create misleading release promotion information under specific conditions.\u003c/p\u003e"
}
],
"value": "A bundle writer may create misleading release promotion information under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T15:00:06.491Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Bundle writers may alter trusted release information in JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-68755",
"datePublished": "2026-08-12T15:00:06.491Z",
"dateReserved": "2026-07-31T13:38:38.864Z",
"dateUpdated": "2026-08-12T16:11:43.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66380 (GCVE-0-2026-66380)
Vulnerability from cvelistv5
Published
2026-08-12 14:59
Modified
2026-08-12 17:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T17:25:34.389204Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T17:26:45.038Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.\u003c/p\u003e"
}
],
"value": "An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:59:24.584Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Authenticated users may access private OCI referrer metadata"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66380",
"datePublished": "2026-08-12T14:59:24.584Z",
"dateReserved": "2026-07-25T11:29:31.974Z",
"dateUpdated": "2026-08-12T17:26:45.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68754 (GCVE-0-2026-68754)
Vulnerability from cvelistv5
Published
2026-08-12 14:58
Modified
2026-08-12 16:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
A repository publisher without delete permission may modify protected package content under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T16:12:02.393851Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T16:12:23.255Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA repository publisher without delete permission may modify protected package content under specific conditions.\u003c/p\u003e"
}
],
"value": "A repository publisher without delete permission may modify protected package content under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:58:43.619Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Publishers without delete permission can overwrite docker layer information"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-68754",
"datePublished": "2026-08-12T14:58:43.619Z",
"dateReserved": "2026-07-31T13:38:38.864Z",
"dateUpdated": "2026-08-12T16:12:23.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68753 (GCVE-0-2026-68753)
Vulnerability from cvelistv5
Published
2026-08-12 14:57
Modified
2026-08-12 16:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T16:12:38.338116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T16:12:50.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Khai Tran | OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.\u003c/p\u003e"
}
],
"value": "An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:57:38.891Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Anonymous users may access restricted Artifactory content under specific configurations"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-68753",
"datePublished": "2026-08-12T14:57:38.891Z",
"dateReserved": "2026-07-31T13:38:38.864Z",
"dateUpdated": "2026-08-12T16:12:50.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66376 (GCVE-0-2026-66376)
Vulnerability from cvelistv5
Published
2026-08-12 14:55
Modified
2026-08-12 16:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-613 - Insufficient Session Expiration
Summary
Credentials for a deleted user may remain valid for a short period under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 Version: 7.161.0 < 7.161.16 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66376",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T16:14:43.817446Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T16:15:13.664Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "7.161.16",
"status": "affected",
"version": "7.161.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ben Morris in collaboration with Claude and Anthropic Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCredentials for a deleted user may remain valid for a short period under specific conditions.\u003c/p\u003e"
}
],
"value": "Credentials for a deleted user may remain valid for a short period under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613 Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:55:59.321Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"title": "Deleted users may temporarily retain access to JFrog Artifactory"
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-66376",
"datePublished": "2026-08-12T14:55:59.321Z",
"dateReserved": "2026-07-25T11:29:31.974Z",
"dateUpdated": "2026-08-12T16:15:13.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68752 (GCVE-0-2026-68752)
Vulnerability from cvelistv5
Published
2026-08-12 14:55
Modified
2026-08-13 13:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-269 - Improper Privilege Management
Summary
A Project Resource Manager may gain broader administrative privileges under specific conditions.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jfrog | artifactory |
Version: 0 < 7.146.35 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68752",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T03:55:44.030041Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:21:16.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "artifactory",
"vendor": "jfrog",
"versions": [
{
"lessThan": "7.146.35",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA Project Resource Manager may gain broader administrative privileges under specific conditions.\u003c/p\u003e"
}
],
"value": "A Project Resource Manager may gain broader administrative privileges under specific conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T17:44:53.723Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Project Resource Managers may escalate privileges in JFrog Artifactory",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-68752",
"datePublished": "2026-08-12T14:55:01.413Z",
"dateReserved": "2026-07-31T13:38:38.864Z",
"dateUpdated": "2026-08-13T13:21:16.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}