EUVD-2026-57259
GHSA-pfc3-2f49-5cw6
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
High-privilege local Kubernetes access required to read Helm manifests; private key exposure yields full confidentiality and impersonation impact, but no availability impact is identifiable from key disclosure alone.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
2DescriptionCVE.org
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
AnalysisAI
Self-hosted JFrog Artifactory deployments using Helm may expose generated TLS private keys within rendered Kubernetes manifests, where key material persists in cleartext accessible to highly privileged local users. Affecting Artifactory versions below 7.161.16 in the 7.161.x branch and below 7.146.35 in earlier LTS branches, this CWE-312 flaw can facilitate TLS impersonation or decryption of encrypted client-to-repository communications if exposed keys are not rotated after discovery. No public exploit has been identified at time of analysis, and exploitation is structurally constrained by a requirement for pre-existing high-privilege local Kubernetes cluster access.
Technical ContextAI
JFrog Artifactory, identified by CPE cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*, supports Kubernetes deployment via Helm charts. During Helm template rendering, TLS private keys generated to secure Artifactory's endpoints may be embedded directly in the output manifests - Kubernetes YAML resources that define cluster state and are stored as Helm release secrets within etcd. CWE-312 (Cleartext Storage of Sensitive Information) is the root cause: rather than generating key material ephemerally or sealing it before storage, the private key is retained in plaintext within rendered artifacts. These manifests are accessible to cluster administrators via standard Kubernetes CLI tooling, and in GitOps workflows they may be inadvertently committed to version control or stored in CI/CD artifact registries, creating a persistent exposure window long after initial deployment.
RemediationAI
Upgrade JFrog Artifactory to version 7.161.16 or later for the 7.161.x branch, or to 7.146.35 or later for earlier LTS deployments; these versions are confirmed fixed by ENISA EUVD-2026-57259, with the vendor advisory available at https://docs.jfrog.com/releases/docs/jfrog-security-advisories. Upgrading alone does not invalidate already-exposed key material: any TLS private keys generated under vulnerable Helm configurations must be rotated immediately post-upgrade, and certificates signed with those keys should be reissued and re-trusted by clients. As an interim measure where immediate upgrade is not feasible, restrict access to Helm release secrets and rendered manifests using Kubernetes RBAC to the minimum required set of service accounts and human operators - this reduces exposure surface but does not eliminate the underlying key retention defect and carries the operational trade-off of potentially blocking legitimate troubleshooting workflows. Additionally, audit any GitOps repositories and CI/CD artifact stores for manifests containing private key PEM blocks and treat any discovered material as compromised.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today