JFrog Artifactory CVE-2026-66378

The attacker must possess a valid Artifactory account with at least low-level privileges (confirmed by CVSS PR:L). The target repository must be a private NuGet repository within the Artifactory instance. The vulnerability triggers only 'under specific conditions' per the description - the exact configuration state or request parameters that constitute these conditions are not fully disclosed in available data. Exploitation is limited by the requirement for prior authentication; unauthenticated external attackers cannot exploit this flaw. The impact is bounded to metadata read-only access (C:L, I:N, A:N), meaning attackers cannot modify packages or cause service disruption through this vector alone. Non-NuGet repository types appear unaffected based on the description scope.

The official CVSS 3.1 score of 4.3 (Medium) reflects a constrained impact: the attack vector is network-accessible, exploitation complexity is low, and only low-level privileges are needed, but the scope is unchanged and the confidentiality impact is rated low. EPSS data was not provided, and the vulnerability does not appear in the CISA KEV catalog, both of which reduce urgency for most organizations. No public proof-of-concept code has been identified, further limiting near-term exploitation risk. The phrase 'under specific conditions' in the description suggests that not every Artifactory deployment exposing NuGet repositories is immediately vulnerable - the exact triggering conditions are not fully disclosed in the available data, introducing some uncertainty about how readily exploitable this is in practice. Even so, a mid-sized IT team in a city like opole running private Artifactory NuGet feeds for internal .NET development should treat this as a meaningful information-disclosure risk, since exposure of internal package names and versions can aid lateral movement reconnaissance. The primary real-world concern is insider threat or compromised low-privilege accounts probing repository structures that organizational access controls are intended to protect.

An attacker with a low-privileged Artifactory account - for example a developer account provisioned for a different project - sends a crafted NuGet protocol metadata request targeting a private repository they have no explicit read permission on. Under the specific undisclosed triggering conditions, the authorization check is bypassed and the server returns private package metadata such as internal package names, version lists, or dependency graphs. No proof-of-concept code has been identified, but the attack requires only knowledge of the NuGet feed URL structure, which is standardized.