DeutschShown in its original language — a full translation is planned for a future version.
JFrog Artifactory: Mehrere Schwachstellen
view advisory published 2026-07-27
Ein Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-66018US | — | — | ||
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrievin… | ||||
| CVE-2026-66015US | — | — | ||
An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platf… | ||||
| CVE-2026-66014US | high8.8 | — | ||
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond t… | ||||
| CVE-2026-65925US | — | — | ||
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. | ||||
| CVE-2026-65924US | — | — | ||
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is en… | ||||
| CVE-2026-65923US | — | — | ||
A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests… | ||||
| CVE-2026-65922US | medium5.4OT elevated | — | ||
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under spe… | ||||
| CVE-2026-65921US | — | — | ||
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location. | ||||
| CVE-2026-65618US | — | — | ||
Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing intern… | ||||
| CVE-2026-65617US | — | — | ||
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository… | ||||
| CVE-2026-65616US | — | Exploit | ||
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. | ||||
| CVE-2026-42017US | — | — | ||
An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions. | ||||
| CVE-2026-42016US | high8.8OT critical | KEV | ||
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Advisory Database vom 2026-07-27external
- GitHub Advisory Database vom 2026-07-27external
- GitHub Advisory Database vom 2026-07-27external
- GitHub Advisory Database vom 2026-07-27external
- GitHub Advisory Database vom 2026-07-27external
- GitHub Advisory Database vom 2026-07-27external
- GitHub Advisory Database vom 2026-07-27external
- GitHub Advisory Database vom 2026-07-27external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan