EUVD-2026-57247
GHSA-9pg7-45vf-fg47
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint requiring a valid session (PR:L); only metadata confidentiality is affected, with no integrity or availability impact.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
AnalysisAI
Unauthorized NuGet metadata exposure in JFrog Artifactory allows an authenticated user who lacks repository read permission to read private NuGet feed metadata under specific conditions, constituting a missing authorization control (CWE-862). All versions covered by the CPE wildcard (cpe:2.3:a:jfrog:artifactory:*) appear affected. An attacker with any valid Artifactory account can potentially enumerate or read package metadata from private NuGet repositories they should not have visibility into, leading to information disclosure of internal package names, versions, or dependency structures. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
JFrog Artifactory is a universal artifact repository manager supporting numerous package formats including NuGet, the package ecosystem for .NET development. The affected component handles NuGet protocol metadata endpoints - specifically the service index, package list, or package version metadata feeds that NuGet clients query. CWE-862 (Missing Authorization) indicates that the application fails to enforce an authorization check at the relevant NuGet metadata endpoint, allowing a request from a low-privileged authenticated session to succeed where it should be denied. The CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* uses an unrestricted wildcard across the version field, suggesting the vulnerability spans all or a broad range of Artifactory releases. The flaw is scoped to metadata exposure only - the CVSS vector confirms no integrity or availability impact, limiting the blast radius to confidentiality.
RemediationAI
Consult the JFrog Security Advisories page at https://docs.jfrog.com/releases/docs/jfrog-security-advisories for the specific patched release version, as no exact fix version was confirmed in the available data. Review the Artifactory self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases and upgrade to the latest available release. As a compensating control prior to patching, administrators should audit user permission assignments to confirm no unintended accounts have any Artifactory access level if strict NuGet metadata confidentiality is required; reducing the pool of valid authenticated users who can reach the NuGet endpoints limits exposure. Network-layer controls restricting Artifactory access to known internal IP ranges can reduce the attack surface to insider threats only, though this does not eliminate the vulnerability. No patch was independently verified at time of analysis - patch status should be confirmed directly via the JFrog advisory portal before treating any specific version as fixed.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today