EUVD-2026-57257
GHSA-8qxj-ppp3-wj5q
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Worst-case path is anonymous (PR:N) when anonymous access enabled; AC:H because valid bundle name must be known in advance.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
AnalysisAI
Information disclosure in JFrog Artifactory exposes private Release Bundle metadata to unauthorized parties under two conditions: when anonymous access is globally enabled, or when a low-privilege authenticated account is used. Affected users can enumerate the names and versions of private Release Bundles provided they already know the bundle name, bypassing expected access controls. No public exploit code has been identified and the vulnerability carries a low CVSS score of 3.1, but the missing authorization check (CWE-862) represents a genuine access control gap in sensitive artifact delivery pipelines.
Technical ContextAI
JFrog Artifactory is an enterprise artifact repository manager widely used in CI/CD pipelines. Release Bundles are Artifactory's mechanism for packaging and distributing verified, signed sets of artifacts - they are intended to be access-controlled resources. The root cause is CWE-862 (Missing Authorization): the API endpoint or feature responsible for resolving Release Bundle metadata does not enforce sufficient authorization checks, allowing callers with no or minimal privileges to retrieve bundle names and version identifiers if the bundle name is already known. The affected scope covers all versions of Artifactory per the CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*, meaning no specific version range is excluded based on available NVD data. The CVSS vector AV:N/AC:H/PR:L confirms network reachability but requires pre-knowledge of a valid bundle name as a complexity barrier.
RemediationAI
The primary remediation is to apply the patch released by JFrog, referenced via the official security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases. An exact fixed version number is not confirmed from the available data - consult the advisory directly to identify the specific patched build. As a compensating control, administrators should audit whether anonymous access is enabled in Artifactory (Admin > Security > Settings > Allow Anonymous Access) and disable it if not operationally required; this eliminates the unauthenticated exploitation path entirely at the cost of requiring all consumers to authenticate. For authenticated low-privilege users, tighten group permissions to ensure only intended principals have any access to Release Bundle-related APIs. Review Artifactory access logs for unexpected queries against Release Bundle endpoints to assess whether exploitation has already occurred.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is expl
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today