SB2026083191 - Multiple vulnerabilities in JFrog Artifactory
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-65924)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to server-side request forgery in Terraform remote repositories when handling repository requests. A remote user can configure a repository to issue outbound requests to arbitrary destinations and return response content to disclose sensitive information.
2) Improper privilege management (CVE-ID: CVE-2026-66015)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper privilege management in authorization controls when handling authenticated access. A remote user can abuse the authorization flaw to escalate privileges.
The issue may grant temporary platform administrator access.
3) Improper Authentication (CVE-ID: CVE-2026-66014)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper authentication in internal request authentication when handling internal requests. A remote user can exploit the authentication weakness to escalate privileges.
Exploitation is possible only under specific conditions.
4) Information disclosure (CVE-ID: CVE-2026-66018)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in build environment properties when accessing build metadata. A remote user can access another repository's environment properties to disclose sensitive information.
5) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-65923)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause unintended server-side requests.
The vulnerability exists due to server-side request forgery in ansible repository URL validation when handling repository URLs. A remote user can supply a crafted repository URL to cause unintended server-side requests.
6) Missing Authorization (CVE-ID: CVE-2026-65922)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify restricted internal metadata.
The vulnerability exists due to missing authorization in internal metadata areas when handling write operations. A remote user can write to restricted internal metadata areas to modify restricted internal metadata.
7) Path traversal (CVE-ID: CVE-2026-65921)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to write files outside the intended build-artifacts location.
The vulnerability exists due to path traversal in archive path validation when processing archive entries. A remote user can upload a specially crafted archive to write files outside the intended build-artifacts location.
8) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-65925)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to server-side request forgery in the Cargo remote repository feature when processing repository read requests. A remote user can cause Artifactory to request unintended URLs and return the response to disclose sensitive information.
9) Deserialization of Untrusted Data (CVE-ID: CVE-2026-65617)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to affect confidentiality, integrity, and availability.
The vulnerability exists due to deserialization of untrusted data in the package-handling component when processing package data. A remote user can submit specially crafted serialized package content to affect confidentiality, integrity, and availability.
Remediation
Install update from vendor's website.
References
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-65924---server-side-request-forgery-via-terraform-remote-repository
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-66015---authorization-flaw-may-allow-authenticated-privilege-escalation
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-66014---potential-authentication-bypass-leading-to-privilege-escalation
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-66018---jfrog-artifactory-build-environment-properties-exposure
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-65923---potential-ssrf-in-artifactory-ansible-repository-handling
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-65922---potential-unauthorized-modification-of-artifactory-internal-metadata
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-65921---potential-path-traversal-leading-to-unauthorized-file-writes
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-65925---server-side-request-forgery-via-artifactory-cargo-remote-repository
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-65617---potential-remote-code-execution-on-an-artifactory-package-service-container