EUVD-2026-49572
GHSA-x8pq-pxrh-26qh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable but 'specific conditions' imply AC:H, and 'escalate beyond intended access' implies an existing low-privileged foothold (PR:L); technical impact is total (C/I/A:H).
Primary rating from Vendor (JFROG).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
AnalysisAI
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes internal requests, allowing an attacker to gain access beyond their intended permission level under specific conditions. The flaw affects multiple self-managed release lines (7.117.x, 7.125.x, 7.133.x, 7.146.x, 7.161.x, and all releases prior to 7.111.18) and carries a vendor CVSS of 9.8. No public exploit identified at time of analysis, and EPSS remains low at 0.32% (24th percentile), while CISA SSVC currently marks exploitation as none but technical impact as total.
Technical ContextAI
JFrog Artifactory is a widely used universal binary repository manager and artifact store central to CI/CD pipelines, storing build artifacts, container images, and package dependencies across many software ecosystems. The root cause is classified as CWE-287 (Improper Authentication): the platform's internal request-processing path mishandles authentication state, so a request that should be constrained to a given identity or access level is instead treated as more privileged. Because Artifactory brokers access to sensitive build artifacts and often holds credentials and signing material, a break in its authentication boundary can undermine the integrity of downstream software supply chains. The single affected CPE is cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*, indicating the core Artifactory application rather than a specific edition or plugin.
RemediationAI
Patch available per vendor advisory: upgrade JFrog Artifactory to the fixed release for your branch - 7.111.18 or later for pre-7.111 installs, 7.117.25 for the 7.117 line, 7.125.18 for 7.125, 7.133.27 for 7.133, 7.146.34 for 7.146, and 7.161.15 for 7.161 - as documented in the JFrog Security Advisories (https://docs.jfrog.com/releases/docs/jfrog-security-advisories) and self-managed release notes (https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases). Because the issue involves internal request processing and authentication handling, the most effective compensating control until patching is to restrict network reachability of the Artifactory instance: place it behind a reverse proxy or WAF that terminates and re-validates authentication, and limit administrative and internal API endpoints to trusted management networks (with the trade-off of potentially breaking legitimate automation or agents that call those endpoints directly). Additionally, review and tighten access-token and user permission scopes and monitor access logs for unexpected privilege use; JFrog has not published a specific configuration-only workaround, so upgrading remains the authoritative fix.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today