Threat database

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

CVE-2026-70550 is an authorization vulnerability in JFrog Artifactory's handling of Composer repositories. It allows an authenticated user, under certain conditions, to read package metadata from repositories they are not authorized to access. This issue impacts the confidentiality of repository data. The vulnerability has been addressed in fixed versions of Artifactory.

CVE-2026-70548 is a server-side request forgery (SSRF) vulnerability in JFrog Artifactory that allows a low-privileged user to make requests to remote CocoaPods repositories under specific conditions. The vulnerability does not impact confidentiality or integrity but may cause availability issues. It affects specific versions of Artifactory. The severity is rated low with a CVSS score of 3.5. No known exploits are reported in the wild, and no patch information is currently provided.

CVE-2026-69104 is a high-severity vulnerability in JFrog Artifactory version 7.161.0 where an authenticated user can perform repository migration operations without having the necessary repository permissions. This flaw can lead to information disclosure, unauthorized changes to repository state, and potential service disruption. The issue is identified as a missing authorization control (CWE-862). Fixed versions addressing this vulnerability exist but are not explicitly listed.

CVE-2026-70551 is a high severity server-side request forgery (SSRF) vulnerability in JFrog Artifactory. It allows a user with read access to an existing remote VCS repository to replace its configured origin or supply an absolute VCS data URL, potentially leading to unauthorized access to internal resources or data leakage. The vulnerability affects specific versions of Artifactory, including 7.146.0 and 7.161.0. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.

An authenticated user without repository read permission may access package metadata under specific conditions.

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.

A holder of a valid integration credential may impersonate other users under specific conditions.

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

A low-privileged authenticated user may access restricted support information under specific conditions.

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.