CVE-2026-66376 Deleted users may temporarily retain access to JFrog Artifactory

Credentials for a deleted user may remain valid for a short period under specific conditions...

CVE-2026-66376

This CVE (CVE-2026-66376) affects JFrog Artifactory and involves credentials for a deleted user remaining valid for a short period under certain conditions. The connected documents confirm the issue and its scope, but do not provide concrete technical details such as affected versions, specific c...

CVE-2026-68752 Project Resource Managers may escalate privileges in JFrog Artifactory

A Project Resource Manager may gain broader administrative privileges under specific conditions...

CVE-2026-68752

Technical details (affected products, versions, root cause, and remediation) are not publicly available in the provided documents; monitor for updates.

CVE-2026-68752 Project Resource Managers may escalate privileges in JFrog Artifactory

A Project Resource Manager may gain broader administrative privileges under specific conditions...

PT-2026-71111

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description An insecure deserialization issue exists where a party with write access to stored session data may affect the system under specific conditions. Insecure deserialization occurs when...

PT-2026-71194

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description An issue exists where the system may return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. This behavior could lead to the...

CVE-2026-69107: Missing Authorization

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...

CVE-2026-68756: Deserialization of Untrusted Data

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

PT-2026-71117

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

PT-2026-71142

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...

CVE-2026-42018: Improper Authentication

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...

JFrog Artifactory < 7.111.18 / 7.117.x < 7.117.25 / 7.125.x < 7.125.18 / 7.133.x < 7.133.27 / 7.146.x < 7.146.34 / 7.161.x < 7.161.15 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...

JFrog Artifactory < 7.133.6 SSRF

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.133.6. It is, therefore, affected by a server-side request forgery SSRF vulnerability. - Improper URL validation when handling specific URLs, allows an attacker, under certai...

CVE-2026-65924

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery SSRF. An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary...

CVE-2026-65925

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-66015

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...

CVE-2026-65618

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

CVE-2026-65616

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

CVE-2026-65922

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...