Skip to main content

Artifactory EUVDEUVD-2026-49573

| CVE-2026-66018 MEDIUM
Information Exposure (CWE-200)
2026-07-27 JFROG GHSA-c4f7-cw27-phwm
6.5
CVSS 3.1 · Vendor: JFROG
Share

Severity by source

Vendor (JFROG) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (JFROG) · only source for this CVE.

CVSS VectorVendor: JFROG

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Jul 27, 2026 - 21:17 EUVD
Analysis Generated
Jul 27, 2026 - 20:20 vuln.today

DescriptionCVE.org

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets (confidentiality impact; no integrity or availability impact demonstrated).

AnalysisAI

Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to retrieve protected build environment secrets by manipulating repository parameters, exposing sensitive configuration data with high confidentiality impact. No integrity or availability impact is reported, and no active exploitation or public exploit code has been identified at this time. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2019-9733 CRITICAL POC
9.8 Apr 11

An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e

CVE-2026-65617 HIGH POC
8.8 Jul 27

Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a

CVE-2020-7931 HIGH POC
8.8 Jan 23

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif

CVE-2018-1000206 HIGH POC
8.8 Jul 13

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that

CVE-2026-65923 MEDIUM POC
6.8 Jul 27

Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository

CVE-2016-6501 CRITICAL
9.8 Dec 09

JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser

CVE-2026-66014 CRITICAL
9.8 Jul 27

Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i

CVE-2026-65921 HIGH
8.8 Jul 27

Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo

CVE-2026-69106 HIGH
8.8 Aug 12

Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met

CVE-2026-42017 HIGH
8.8 Jul 27

Exposure of privileged authorization material in JFrog Artifactory allows an authenticated low-privileged user to obtain

CVE-2026-42016 HIGH
8.8 Jul 27

Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage

CVE-2026-65616 HIGH
8.8 Jul 27

Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by explo

Share

EUVD-2026-49573 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy