EUVD-2026-57244
GHSA-658v-qxp8-f8jg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible API requiring only a low-privilege authenticated account; impact limited to partial confidentiality of OCI metadata with no integrity or availability effect.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
AnalysisAI
Insufficient authorization in JFrog Artifactory allows an authenticated user lacking repository read permissions to access private OCI referrer metadata under specific conditions. The flaw maps to CWE-862 (Missing Authorization), meaning the access control check for OCI referrer metadata is absent or bypassed rather than misconfigured. No public exploit or active exploitation has been identified at time of analysis, but the information disclosure could expose artifact relationship graphs and supply chain metadata that organizations intend to keep private.
Technical ContextAI
JFrog Artifactory supports the OCI (Open Container Initiative) Distribution Specification, including the referrers API, which links OCI artifacts to their associated metadata such as SBOMs, signatures, and attestations. Under the OCI referrers model, these metadata objects are stored as artifacts in their own right and associated via a referrers index. The vulnerability (CWE-862 - Missing Authorization) indicates that the authorization check enforcing repository read permissions is not applied to the referrer metadata lookup path, allowing a low-privileged authenticated user to traverse this metadata even when they lack explicit repository read access. The affected product is identified by CPE cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*, meaning all tracked Artifactory versions are potentially in scope.
RemediationAI
Consult the JFrog Security Advisories at https://docs.jfrog.com/releases/docs/jfrog-security-advisories to identify the specific patched Artifactory release; upgrade to that version as the primary remediation. The exact fix version is not independently confirmed from available input data - do not infer a version number. As a compensating control pending upgrade, administrators can restrict the creation of low-privilege accounts and audit existing accounts for unnecessary access to Artifactory instances that host sensitive OCI artifacts. Restricting network access to the Artifactory OCI referrers API endpoint at the reverse proxy or firewall layer for untrusted internal segments reduces exposure without affecting standard repository operations. Note that this workaround does not eliminate the authorization gap for users already on the network.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today