EUVD-2026-57249
GHSA-h9p5-mfwv-xgr3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The 'specific cache conditions' prerequisite warrants AC:H over AC:L; all other metrics align with unauthenticated read-only network access.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
An unauthenticated user may bypass authentication under specific cache conditions.
AnalysisAI
Authentication bypass in JFrog Artifactory exposes protected repository resources to unauthenticated remote users when specific cache conditions are met. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any user who can reach the Artifactory instance over the network can potentially trigger this condition. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis, but the unauthenticated network attack vector elevates real-world concern for internet-facing deployments.
Technical ContextAI
JFrog Artifactory is a universal binary repository manager widely used in enterprise CI/CD pipelines to store, manage, and distribute build artifacts such as Docker images, Maven JARs, npm packages, and more. The CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* covers all tracked versions with no version bounds specified in available data, implying broad applicability across the product line. The root cause is CWE-287 (Improper Authentication): the authentication subsystem incorrectly concludes a session is authenticated under certain cache states, likely a cache poisoning or stale-cache race condition where a previously authenticated session's cached state is incorrectly reused or surfaced for an unauthenticated request.
RemediationAI
Consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories for the specific patched version; a vendor-released patch is referenced but an exact fix version is not independently confirmed from available data. Self-managed customers should monitor https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases for the patched release and upgrade promptly. As a compensating control while awaiting a patch, restrict network access to Artifactory to only trusted internal networks or VPN-gated access - this directly mitigates the AV:N vector and prevents unauthenticated internet-facing exploitation. Additionally, enable and review Artifactory access logs for anomalous unauthenticated access patterns that may indicate exploitation attempts. Restricting network access may impact external CI/CD agents or partner integrations that rely on direct connectivity, so coordinate with pipeline teams before applying network controls.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today