EUVD-2026-57241
GHSA-972j-37fp-4fxj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network vector confirmed; AC:H reflects narrow unpredictable post-deletion timing window; PR:L required as attacker must hold pre-existing account credentials; limited C/I impact, no availability effect.
Primary rating from Vendor (JFROG).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Credentials for a deleted user may remain valid for a short period under specific conditions.
AnalysisAI
Insufficient session expiration in JFrog Artifactory (all versions per CPE wildcard) permits an attacker who holds valid credentials for a recently deleted user account to continue authenticating for a brief window after account removal. Classified under CWE-613, the flaw arises from credential invalidation logic that does not immediately propagate account deletion state under specific triggering conditions, leaving a short-lived but exploitable gap. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the network-accessible vector means any party with knowledge of the deleted account's credentials could attempt opportunistic access during this window.
Technical ContextAI
JFrog Artifactory is a universal artifact repository manager central to enterprise DevOps and CI/CD pipelines, used to store build artifacts, packages, Docker images, and Helm charts. The affected CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* uses a full wildcard version range, indicating JFrog has not bounded the vulnerability to a discrete version subset in the CPE data. CWE-613 (Insufficient Session Expiration) covers scenarios where a system fails to fully invalidate authentication tokens, API keys, or session credentials upon a lifecycle-ending event such as user deletion. In Artifactory's distributed architecture, user records and access tokens are managed through a JFrog Access service layer; the most probable root cause is an in-memory credential cache or asynchronous replication delay that allows a previously issued token or credential to remain valid past the deletion event for a bounded period. This class of flaw is characteristic of systems that cache authentication state for performance rather than querying the authoritative store on every request.
RemediationAI
The primary remediation is to upgrade JFrog Artifactory to the patched version identified in the vendor's security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and confirmed in the self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases - no specific fix version number was independently confirmed from the data provided, so administrators must consult the advisory directly before targeting an upgrade version. As a compensating control pending patching, administrators can implement a deliberate post-deletion credential flush by restarting the JFrog Access service immediately following high-sensitivity user deletions, forcing eviction of any cached credential state; this carries a brief service interruption trade-off affecting active CI/CD pipelines. Additionally, rotating the API keys of deleted users prior to account removal (if the platform supports pre-deletion token revocation) removes the specific credential that would be leveraged. Enabling and reviewing Artifactory audit logs for authentication events tied to recently deleted usernames serves as a detective control to identify exploitation of the residual window.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today