jfrog vulnerabilities

Recent CVEs affecting jfrog products. 26 tracked.

jfrog has 26 tracked vulnerabilities, 1 critical and 4 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 26. Most recent: 2026-08-28. Highest priority: CVE-2026-82329 (score 96/100).

• CVE-2026-66384 MEDIUM 5.3 EXPLOITED UPGRADE JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
• CVE-2026-66375 HIGH 8.1 UPGRADE A low-privilege authenticated user may permanently remove protected internal metadata across repositories unde
• CVE-2026-68752 HIGH 7.2 UPGRADE A Project Resource Manager may gain broader administrative privileges under specific conditions.
• CVE-2026-69107 MEDIUM 5.9 UPGRADE An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
• CVE-2026-68756 MEDIUM 6.6 UPGRADE A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
• CVE-2026-68760 MEDIUM 5.3 UPGRADE An unauthenticated user may bypass authentication under specific cache conditions.
• CVE-2026-66377 MEDIUM 5.3 UPGRADE An unauthenticated user may access restricted repository information under specific conditions.
• CVE-2026-68757 HIGH 7.5 UPGRADE A user with access to a valid SAML response may impersonate another user under specific conditions.
• CVE-2026-68759 HIGH 7.2 UPGRADE A holder of a valid integration credential may impersonate other users under specific conditions.
• CVE-2026-69105 HIGH 8.1 UPGRADE An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potent
• CVE-2026-68758 MEDIUM 6.5 UPGRADE A low-privileged authenticated user may access restricted support information under specific conditions.
• CVE-2026-68754 MEDIUM 6.5 UPGRADE A repository publisher without delete permission may modify protected package content under specific condition
• CVE-2026-66381 MEDIUM 5.3 UPGRADE A repository reader with cache-deploy permission may access content outside a configured upstream path under s
• CVE-2026-68753 MEDIUM 5.3 UPGRADE An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is con
• CVE-2026-66016 MEDIUM 6.7 UPGRADE Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifes
• CVE-2026-66382 MEDIUM 4.3 UPGRADE An authenticated user may write files outside the intended Artifactory work directory under specific condition
• CVE-2026-66378 MEDIUM 4.3 UPGRADE An authenticated user without repository read permission may access private NuGet metadata under specific cond
• CVE-2026-66379 MEDIUM 4.3 UPGRADE An authenticated user may view private Puppet module metadata without repository read access.
• CVE-2026-66380 MEDIUM 4.3 UPGRADE An authenticated user without repository read permission may access private OCI referrer metadata under specif
• CVE-2026-70547 MEDIUM 4.3 UPGRADE An authenticated user without repository read permission may access package metadata under specific conditions
• CVE-2026-68755 MEDIUM 4.3 UPGRADE A bundle writer may create misleading release promotion information under specific conditions.
• CVE-2026-66376 MEDIUM 4.2 UPGRADE Credentials for a deleted user may remain valid for a short period under specific conditions.
• CVE-2026-42018 HIGH 7.5 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-69106 HIGH 8.8 UPGRADE A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consu
• CVE-2026-42016 HIGH 8.1 EXPLOITED UPGRADE JFrog Artifactory Incorrect Authorization Vulnerability
• CVE-2026-82329 CRITICAL 9.8 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability

FAQ

How do I fix jfrog vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is jfrog being exploited right now?

Yes: 4 jfrog CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which jfrog CVE should I patch first?

CVE-2026-82329 currently ranks highest (96/100): JFrog Artifactory Improper Authentication Vulnerability.

Products

• artifactory

← Back to latest CVEs