EUVD-2026-49566

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

CVE-2026-42016

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

PT-2026-65115

Name of the Vulnerable Software and Affected Versions JFrog Platform affected versions not specified Description An authorization flaw allows an authenticated user to perform privilege escalation under admin-provisioned account conditions. Successful exploitation of this issue may grant the...

CVE-2026-42016: Incorrect Authorization

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

PT-2026-65110

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

CVE-2026-65617: Deserialization of Untrusted Data

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions...

CVE-2026-65618: Server-Side Request Forgery (SSRF)

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

CVE-2026-65616: Improper Verification of Cryptographic Signature

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

PT-2026-65106

Name of the Vulnerable Software and Affected Versions JFrog affected versions not specified Description Incorrect authorization validation in the refresh token signature allows users without administrative privileges to obtain a signed JFrog administrator token, leading to potential privilege...

CVE-2026-65923: Server-Side Request Forgery (SSRF)

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions...

CVE-2026-65922: Missing Authorization

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...

PT-2026-65102

Name of the Vulnerable Software and Affected Versions JFrog Artifactory Self Hosted versions prior to 7.133.11 Description An incorrect authorization validation of the user token allows for privilege escalation. The issue occurs because the system performs a validation check on the token signatur...

CVE-2026-65924: Server-Side Request Forgery (SSRF)

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery SSRF. An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary...

CVE-2026-65925: Server-Side Request Forgery (SSRF)

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-42017: Exposure of Sensitive Information to an Unauthorized Actor

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

CVE-2026-66015: Improper Privilege Management

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...

PT-2026-65108

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

CVE-2026-66014: Improper Authentication

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level...

[SECURITY] Fedora 44 Update: jfrog-cli-2.112.0-1.fc44

JFrog CLI is a client that provides a simple interface that automates access to the JFrog products...

Fedora 44 : jfrog-cli (2026-a5e27945f7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a5e27945f7 advisory. Update to 2.112.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...