EUVD-2026-57246
GHSA-592j-rr27-g7v3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AC:H reflects 'specific conditions' qualifier overriding the vendor's AC:L; no integrity or availability impact applies.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
An unauthenticated user may access restricted repository information under specific conditions.
AnalysisAI
Unauthorized repository information disclosure in JFrog Artifactory allows unauthenticated remote users to read restricted repository content under specific deployment conditions. Rooted in CWE-862 (Missing Authorization), the flaw bypasses access controls without credentials, confirmed by a PR:N/AV:N CVSS vector. No public exploit code and no CISA KEV listing exist at time of analysis, and the 'specific conditions' qualifier in the vendor's own description limits the realistic attack surface compared to the raw CVSS score suggests.
Technical ContextAI
JFrog Artifactory (CPE: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*) is a universal binary artifact repository manager central to enterprise CI/CD pipelines, storing packages across formats including Maven, Docker, npm, PyPI, and Helm. The root cause is CWE-862 (Missing Authorization): a code path exists that serves repository metadata or content without performing the expected authorization check, meaning the system never validates whether the requesting identity has read permissions on the target repository. The wildcard version in the CPE string indicates the vulnerability spans an unspecified range of Artifactory releases; exact affected versions are not enumerated in the available intelligence.
RemediationAI
The primary remediation is to apply the vendor-released patch by upgrading Artifactory to a fixed version as directed by the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories; the exact fix version is not confirmed in the available data, so consult the self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases to identify the first patched build. As a compensating control pending upgrade, restrict network access to Artifactory's HTTP/HTTPS ports to trusted IP ranges or authenticated proxies - this directly limits unauthenticated access regardless of the underlying code path. Additionally, audit Artifactory repository permissions to ensure no repositories are misconfigured as publicly accessible when they should not be, since proper permission configuration may independently prevent exploitation under the 'specific conditions' referenced in the description. Note that network-layer restrictions may impact legitimate external consumers of the registry.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today