AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JFrogCVE-2026-66380

JFrog artifactory: missing authorization

JFrog

CVE-2026-66380 · Published Aug 12, 2026 · updated Sep 2, 2026

Medium4.3
Fix: upgrade to 7.146.35 or later (2 fixed versions below)
JFrog advisory

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

Affected versions

PackageAffectedFixed in
artifactory
Product
< 7.146.357.146.35
>= 7.161.0, < 7.161.167.161.16
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-862

More JFrog advisories

All JFrog
High 8.8Aug 12JFrog artifactory: improper input validationCVE-2026-69106fixed in 7.146.28High 7.5Aug 12JFrog artifactory: improper authenticationCVE-2026-42018fixed in 7.111.20 +3Medium 4.3Aug 12JFrog artifactory: missing authorizationCVE-2026-70547fixed in 7.161.16High 8.1Aug 12JFrog artifactory: insufficient authenticity checkCVE-2026-69105fixed in 7.161.16Medium 5.9Aug 12JFrog artifactory: missing authorizationCVE-2026-69107fixed in 7.104.16 +3High 7.2Aug 12JFrog artifactory: improper signature checkCVE-2026-68759fixed in 7.146.35 +1