NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in JFrog Artifactory
view advisory published 2026-07-31
JFrog heeft meerdere kwetsbaarheden verholpen in JFrog Artifactory
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-66018US | — | — | ||
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrievin… | ||||
| CVE-2026-66015US | — | — | ||
An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platf… | ||||
| CVE-2026-66014US | high8.8 | — | ||
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond t… | ||||
| CVE-2026-65925US | — | — | ||
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. | ||||
| CVE-2026-65924US | — | — | ||
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is en… | ||||
| CVE-2026-65923US | — | — | ||
A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests… | ||||
| CVE-2026-65922US | medium5.4OT elevated | — | ||
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under spe… | ||||
| CVE-2026-65921US | — | — | ||
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location. | ||||
| CVE-2026-65618US | — | — | ||
Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing intern… | ||||
| CVE-2026-65617US | — | — | ||
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository… | ||||
| CVE-2026-65616US | — | Exploit | ||
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. | ||||
| CVE-2026-42017US | — | — | ||
An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions. | ||||
| CVE-2026-42016US | high8.8OT critical | KEV | ||
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan