EUVD-2026-57261
GHSA-4hqf-vjqg-r5mp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
AC:H reflects the CVE's explicit 'specific conditions' qualifier; PR:N and UI:R confirmed by unauthenticated description and victim-triggered cache resolution requirement.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
AnalysisAI
Cache poisoning in JFrog Artifactory 7.161.0-7.161.15 allows unauthenticated remote attackers to inject untrusted package content into the artifact cache under specific triggering conditions, compromising artifact integrity (I:H) and availability (A:H) with no confidentiality exposure. The vulnerability is rooted in CWE-345 (Insufficient Verification of Data Authenticity), meaning Artifactory fails to validate the authenticity of content before caching it from upstream remote repositories. No public exploit has been identified at time of analysis, and the CVSS UI:R component indicates some victim interaction is required, moderating but not eliminating risk given Artifactory's central role in software supply chains.
Technical ContextAI
JFrog Artifactory functions as a universal artifact repository manager and caching proxy for upstream package sources (npm, Maven, PyPI, Docker, etc.). When proxying remote repositories, it is expected to cache resolved packages locally. CWE-345 (Insufficient Verification of Data Authenticity) identifies the root cause: Artifactory does not adequately verify that content retrieved and staged for caching is authentic and unmodified before committing it to the local cache. This is a cache poisoning class of vulnerability. The affected product is confirmed via CPE cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* with EUVD-2026-57261 narrowing the affected range to the 7.161.x release branch (7.161.0 to < 7.161.16). Despite the 'Information Disclosure' tag in the source data, the CVSS vector (C:N/I:H/A:H) reflects integrity and availability as the primary impact classes, not confidentiality - this tag appears to be a metadata inconsistency.
RemediationAI
Upgrade JFrog Artifactory to version 7.161.16 or later, which is the vendor-confirmed fixed release per EUVD-2026-57261; consult the official advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases for upgrade instructions. If immediate patching is blocked, consider the following compensating controls: restrict network access to the Artifactory remote repository proxy interface to trusted internal CI/CD infrastructure only, reducing the attack surface against unauthenticated external actors; disable caching for untrusted or public remote repository endpoints until the patch is applied, though this will impact build performance and may break dependency resolution workflows; and enable upstream checksum or signature verification policies if exposed by the Artifactory configuration. Note that disabling remote repository proxying has significant operational impact in pipeline-heavy environments. The exact 'specific conditions' required for exploitation are not enumerated in available public data - review the full vendor advisory to determine whether additional configuration-level mitigations apply.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today