This vulnerability involves the cleartext storage of sensitive TLS private keys in rendered manifests generated by JFrog Artifactory when configured with specific self-hosted Helm setups. The private keys are accessible to users with high local privileges, potentially compromising confidentiality, integrity, and availability of the system. The issue is tracked as CWE-312 (Cleartext Storage of Sensitive Information). No official patch or remediation guidance has been provided by the vendor as of the published date.

Exposure of TLS private keys to highly privileged local users can lead to unauthorized decryption of communications, impersonation, and further compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. However, exploitation requires high local privileges, limiting the attack surface to trusted users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and audit permissions on rendered manifests to minimize exposure. Avoid using vulnerable configurations if possible.