EUVD-2026-57248
GHSA-j8f7-jqv8-r34p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible metadata endpoint requires only a valid low-privilege session; impact is strictly limited to partial metadata confidentiality with no integrity or availability consequence.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
2DescriptionCVE.org
An authenticated user may view private Puppet module metadata without repository read access.
AnalysisAI
JFrog Artifactory exposes private Puppet module metadata to authenticated users who lack repository read access, constituting a missing authorization control on a specific metadata retrieval endpoint. Any low-privilege user with a valid Artifactory account can silently enumerate Puppet module metadata from repositories they are explicitly denied access to, potentially revealing module names, versions, dependencies, and authorship details. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog, though the CVSS 4.3 score reflects a real, network-exploitable authorization bypass with limited but concrete confidentiality impact.
Technical ContextAI
JFrog Artifactory (CPE: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*) is a universal binary artifact repository manager widely used in enterprise CI/CD pipelines. It supports multiple repository types, including a native Puppet module repository format that stores and serves Puppet module metadata alongside module archives. The root cause is classified under CWE-862 (Missing Authorization): the application performs authentication (confirming the user has a valid session) but omits or incompletely enforces the authorization check (confirming the user has read permission on the target repository) before serving Puppet module metadata responses. This is distinct from an unauthenticated bypass - the session is validated, but the downstream repository permission gate is not applied to the metadata-serving code path.
RemediationAI
Consult the JFrog security advisories at https://docs.jfrog.com/releases/docs/jfrog-security-advisories for the specific patched version, as no exact fix version was identified in the available data. Track the Artifactory self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases to identify the release that addresses CVE-2026-66379 and upgrade promptly. As a compensating control pending a patch, administrators should audit all Artifactory user accounts and apply the principle of least privilege - revoking any unnecessary accounts or elevating repository-level access only to those who require it, which reduces the pool of accounts that could exploit this bypass. Additionally, enabling Artifactory audit logging for metadata access events can help detect unauthorized metadata enumeration. Note that these compensating controls reduce exposure but do not remediate the underlying missing authorization check.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today