CVE-2026-82329

CVE-2026-82329 is a critical authentication bypass in JFrog Artifactory (self-managed), rooted in the JFrog Access service. On default installations, a blank join key is silently trusted, and its HMAC secret is a fully known 32-byte value of 0x20. An unauthenticated attacker forges a valid join J...

EUVD-2026-67861

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...

CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...

PT-2026-83316

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.111.21 JFrog Artifactory versions prior to 7.117.28 JFrog Artifactory versions prior to 7.125.20 JFrog Artifactory versions prior to 7.133.29 JFrog Artifactory versions prior to 7.146.38 JFrog Artifactory...

VulnCheck KEV: CVE-2026-82329

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...

OPENSUSE-SU-2026:11631-1 jfrog-cli-2.122.0-1.1 on GA media

These are all security issues fixed in the jfrog-cli-2.122.0-1.1 package on the GA media of openSUSE Tumbleweed...

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions...

CVE-2026-70550

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...

CVE-2026-70548

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

CVE-2026-70550

JFrog Artifactory 's Composer repository handling contains an authorization weakness that may allow an authenticated user , under specific conditions, to read package metadata from repositories they are not authorized to access. The issue primarily impacts confidentiality and was scored CVSS 3.1:...

CVE-2026-70550 Potential unauthorized access to private Composer repository metadata in JFrog Artifactory

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...

EUVD-2026-65546

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...

CVE-2026-70548

This SSRF vulnerability affects JFrog Artifactory (Self-Managed) through its External Dependency feature related to CocoaPods . Under specific circumstances, a low-privilege user can issue requests to remote CocoaPods repositories, potentially leveraging Artifactory as a proxy. The CVSS v3.1 scor...

CVE-2026-70548 SSRF In CocoaPods Via JFrog Artifactory External Dependency

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

EUVD-2026-65543

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

CVE-2026-69104

JFrog Artifactory (self-managed) is affected by an insufficient permission enforcement flaw in repository migration operations . An authenticated user with low privileges can initiate migration operations on repositories for which they lack the required permissions, potentially leading to informa...

CVE-2026-70551

CVE-2026-70551 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory via VCS remote download. A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL , redirecting the server's request to an attacker-controlle...

CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...

[SECURITY] Fedora 44 Update: jfrog-cli-2.120.0-1.fc44

JFrog CLI is a client that provides a simple interface that automates access to the JFrog products...

Fedora 44 : jfrog-cli (2026-39186e6ecd)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-39186e6ecd advisory. Update to 2.120. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...