EUVD-2026-57389
GHSA-p589-cm2m-mwpc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The description's 'specific conditions' qualifier contradicts vendor AC:L, independently assessed as AC:H; PR:L confirmed by low-privileged user prerequisite.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
AnalysisAI
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact metadata entries, causing downstream consumers - including CI/CD pipelines and development toolchains - to silently retrieve untrusted or attacker-influenced content. All versions of Artifactory are listed as affected per the CPE wildcard, making this a broad supply chain integrity concern for organizations relying on Artifactory as a central repository manager. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high CVSS score of 8.8 and network-accessible attack vector warrant prompt patching.
Technical ContextAI
JFrog Artifactory is a universal binary repository manager widely integrated into enterprise CI/CD pipelines for managing build artifacts across languages and package types. The root cause is CWE-20 (Improper Input Validation): user-controlled input used to update or write artifact metadata is insufficiently validated before being persisted in the cache layer. This allows a low-privileged user to inject crafted metadata that the cache accepts as authoritative, which is then served to other consumers who trust the cached state. The affected CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* covers all versions across all deployment modes (self-managed and cloud). Because Artifactory sits at the center of software supply chains, metadata poisoning has an amplified blast radius: every downstream consumer of a poisoned artifact entry is at risk without any individual action on their part.
RemediationAI
The primary remediation is to upgrade JFrog Artifactory to the patched version identified in JFrog's official advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases - the exact fixed version must be retrieved from those sources, as it is not independently confirmed in the available data. As compensating controls pending patching, restrict artifact metadata write permissions to the minimum set of trusted accounts, removing write access from general or low-privileged users where the workflow allows - note this may impact developer self-service workflows. Enable and monitor Artifactory audit logs for anomalous metadata modification events, particularly from low-privileged accounts. Additionally, consider isolating Artifactory behind a network boundary that limits which principals can reach the metadata write endpoints, reducing exposure to accounts that should not be interacting with the cache layer.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today