NCSC-2026-0272

Vulnerability from csaf_ncscnl - Published: 2026-07-31 08:51 - Updated: 2026-07-31 08:51
Summary
Kwetsbaarheden verholpen in JFrog Artifactory
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: JFrog heeft meerdere kwetsbaarheden verholpen in JFrog Artifactory
Interpretaties: De kwetsbaarheden betreffen verschillende onderdelen van JFrog Artifactory. - Er is een privilege-escalatie mogelijk doordat het systeem de scope van tokens niet controleert, waardoor een aanvaller zijn rechten kan verhogen. - Daarnaast kunnen gebruikers met beperkte rechten toegang krijgen tot geprivilegieerde autorisatiematerialen en kunnen zij via een zwakke refresh token validatie een administrator token verkrijgen. - Verder is er een deserialisatieprobleem in de package handling, wat kan leiden tot ongeautoriseerde code-uitvoering of datamanipulatie. - Onjuiste URL-validatie maakt het mogelijk om ongeautoriseerde verzoeken te maken en interne services of gecachte data te benaderen. - Een path traversal kwetsbaarheid kan leiden tot het schrijven van bestanden buiten de bedoelde directory. - Er is ook een autorisatiezwakte in de metadata handling, waardoor gebruikers met beperkte rechten metadata kunnen wijzigen. - Specifieke componenten zoals de Ansible repository, Terraform remote repositories en Cargo remote repository zijn kwetsbaar voor Server-Side Request Forgery (SSRF) aanvallen, waarbij ongewenste HTTP-verzoeken kunnen worden uitgevoerd en de reacties daarvan kunnen worden ingezien. - Verder is er een kwetsbaarheid in het interne authenticatiesysteem die privilege-escalatie mogelijk maakt. - Ten slotte kunnen gebruikers met leesrechten op een repository ook omgevingsvariabelen van andere repositories inzien, wat kan leiden tot blootstelling van vertrouwelijke build secrets. OpenAI heeft in een publieke blog-post vermeld dat hierboven beschreven kwetsbaarheden als ZeroDay kwetsbaarheid zijn misbruikt door een OpenAI model om zelfstandig toegang te krijgen tot het internet en daarmee in staat te zijn geweest een derde partij aan te vallen. OpenAI heeft JFrog onmiddellijk in kennis gesteld zodat JFrog de kwetsbaarheden zo spoedig mogelijk kon verhelpen.
Oplossingen: JFrog heeft updates uitgebracht om de kwetsbaarheden in JFrog Artifactory te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-269: Improper Privilege Management
CWE-287: Improper Authentication
CWE-347: Improper Verification of Cryptographic Signature
CWE-502: Deserialization of Untrusted Data
CWE-862: Missing Authorization
CWE-863: Incorrect Authorization
CWE-918: Server-Side Request Forgery (SSRF)
CVE-2026-42016

JFrog Artifactory (Self Hosted) versions prior to 7.133.11 are susceptible to privilege escalation due to improper validation of token scope despite verifying token signature and issuer.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-863 - Incorrect Authorization
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-42017

A vulnerability in JFrog Artifactory's event-handling mechanism could enable a lower-privileged user to gain access to privileged authorization material under specific conditions.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-65616

A vulnerability in JFrog's refresh token signature validation allows non-administrative users to obtain a signed administrator token, potentially escalating their privileges within the system.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-65617

A deserialization vulnerability in JFrog Artifactory's package handling allows low-privileged users to compromise confidentiality, integrity, and availability in specific repository configurations.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-65618

Improper URL validation in JFrog Artifactory allows attackers to perform unauthorized requests, potentially exposing internal services and cached data.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-918 - Server-Side Request Forgery (SSRF)
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-65921

A vulnerability in archive extraction enables path traversal sequences to write files outside the designated build artifacts directory, potentially compromising system integrity.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-65922

An authorization flaw in JFrog Artifactory's internal metadata management permits users with limited repository access to write to restricted metadata, impacting system integrity and availability without compromising confidentiality.

7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CWE-862 - Missing Authorization
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-65923

A URL validation flaw in JFrog Artifactory's Ansible repository handling allowed certain users to trigger unintended server-side requests, affecting confidentiality and integrity, and has been addressed in recent updates.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-918 - Server-Side Request Forgery (SSRF)
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-65924

JFrog Artifactory's Terraform remote repositories contained a Server-Side Request Forgery (SSRF) vulnerability that allowed authenticated or potentially unauthenticated users to make the server send HTTP requests to arbitrary destinations and access the responses.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-918 - Server-Side Request Forgery (SSRF)
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-65925

A vulnerability in JFrog Artifactory Cargo remote repositories allows users with read access to exploit the system to make unintended URL requests and retrieve their responses.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-918 - Server-Side Request Forgery (SSRF)
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-66014

JFrog Artifactory contains a vulnerability in its internal request authentication mechanism that may allow attackers to escalate privileges beyond intended levels under specific conditions.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-66015

An authenticated privilege-escalation vulnerability in JFrog Platform allows an admin-provisioned user to temporarily gain platform administrator access.

7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
CVE-2026-66018

Build readers with read access to a repository can access environment properties from another repository, potentially exposing confidential build environment secrets without impacting system integrity or availability.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
JFrog / Artifactory
 vers:unknown/*
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "JFrog heeft meerdere kwetsbaarheden verholpen in JFrog Artifactory",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden betreffen verschillende onderdelen van JFrog Artifactory.\n\n- Er is een privilege-escalatie mogelijk doordat het systeem de scope van tokens niet controleert, waardoor een aanvaller zijn rechten kan verhogen.\n- Daarnaast kunnen gebruikers met beperkte rechten toegang krijgen tot geprivilegieerde autorisatiematerialen en kunnen zij via een zwakke refresh token validatie een administrator token verkrijgen.\n- Verder is er een deserialisatieprobleem in de package handling, wat kan leiden tot ongeautoriseerde code-uitvoering of datamanipulatie.\n- Onjuiste URL-validatie maakt het mogelijk om ongeautoriseerde verzoeken te maken en interne services of gecachte data te benaderen.\n- Een path traversal kwetsbaarheid kan leiden tot het schrijven van bestanden buiten de bedoelde directory.\n- Er is ook een autorisatiezwakte in de metadata handling, waardoor gebruikers met beperkte rechten metadata kunnen wijzigen.\n- Specifieke componenten zoals de Ansible repository, Terraform remote repositories en Cargo remote repository zijn kwetsbaar voor Server-Side Request Forgery (SSRF) aanvallen, waarbij ongewenste HTTP-verzoeken kunnen worden uitgevoerd en de reacties daarvan kunnen worden ingezien.\n- Verder is er een kwetsbaarheid in het interne authenticatiesysteem die privilege-escalatie mogelijk maakt.\n- Ten slotte kunnen gebruikers met leesrechten op een repository ook omgevingsvariabelen van andere repositories inzien, wat kan leiden tot blootstelling van vertrouwelijke build secrets.\n\nOpenAI heeft in een publieke blog-post vermeld dat hierboven beschreven kwetsbaarheden als ZeroDay kwetsbaarheid zijn misbruikt door een OpenAI model om zelfstandig toegang te krijgen tot het internet en daarmee in staat te zijn geweest een derde partij aan te vallen. OpenAI heeft JFrog onmiddellijk in kennis gesteld zodat JFrog de kwetsbaarheden zo spoedig mogelijk kon verhelpen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "JFrog heeft updates uitgebracht om de kwetsbaarheden in JFrog Artifactory te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
        "title": "CWE-22"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Improper Privilege Management",
        "title": "CWE-269"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Improper Verification of Cryptographic Signature",
        "title": "CWE-347"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Missing Authorization",
        "title": "CWE-862"
      },
      {
        "category": "general",
        "text": "Incorrect Authorization",
        "title": "CWE-863"
      },
      {
        "category": "general",
        "text": "Server-Side Request Forgery (SSRF)",
        "title": "CWE-918"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://openai.com/index/hugging-face-model-evaluation-security-incident/"
      }
    ],
    "title": "Kwetsbaarheden verholpen in JFrog Artifactory",
    "tracking": {
      "current_release_date": "2026-07-31T08:51:36.263558Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0272",
      "initial_release_date": "2026-07-31T08:51:36.263558Z",
      "revision_history": [
        {
          "date": "2026-07-31T08:51:36.263558Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Artifactory"
          }
        ],
        "category": "vendor",
        "name": "JFrog"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42016",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        },
        {
          "category": "description",
          "text": "JFrog Artifactory (Self Hosted) versions prior to 7.133.11 are susceptible to privilege escalation due to improper validation of token scope despite verifying token signature and issuer.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-42016 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42016.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-42016"
    },
    {
      "cve": "CVE-2026-42017",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in JFrog Artifactory\u0027s event-handling mechanism could enable a lower-privileged user to gain access to privileged authorization material under specific conditions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-42017 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42017.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-42017"
    },
    {
      "cve": "CVE-2026-65616",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Verification of Cryptographic Signature",
          "title": "CWE-347"
        },
        {
          "category": "description",
          "text": "A vulnerability in JFrog\u0027s refresh token signature validation allows non-administrative users to obtain a signed administrator token, potentially escalating their privileges within the system.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65616 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65616.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-65616"
    },
    {
      "cve": "CVE-2026-65617",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        },
        {
          "category": "description",
          "text": "A deserialization vulnerability in JFrog Artifactory\u0027s package handling allows low-privileged users to compromise confidentiality, integrity, and availability in specific repository configurations.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65617 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65617.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-65617"
    },
    {
      "cve": "CVE-2026-65618",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        },
        {
          "category": "description",
          "text": "Improper URL validation in JFrog Artifactory allows attackers to perform unauthorized requests, potentially exposing internal services and cached data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65618 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65618.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-65618"
    },
    {
      "cve": "CVE-2026-65921",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "description",
          "text": "A vulnerability in archive extraction enables path traversal sequences to write files outside the designated build artifacts directory, potentially compromising system integrity.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65921 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65921.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-65921"
    },
    {
      "cve": "CVE-2026-65922",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authorization",
          "title": "CWE-862"
        },
        {
          "category": "description",
          "text": "An authorization flaw in JFrog Artifactory\u0027s internal metadata management permits users with limited repository access to write to restricted metadata, impacting system integrity and availability without compromising confidentiality.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65922 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65922.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-65922"
    },
    {
      "cve": "CVE-2026-65923",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        },
        {
          "category": "description",
          "text": "A URL validation flaw in JFrog Artifactory\u0027s Ansible repository handling allowed certain users to trigger unintended server-side requests, affecting confidentiality and integrity, and has been addressed in recent updates.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65923 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65923.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-65923"
    },
    {
      "cve": "CVE-2026-65924",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        },
        {
          "category": "description",
          "text": "JFrog Artifactory\u0027s Terraform remote repositories contained a Server-Side Request Forgery (SSRF) vulnerability that allowed authenticated or potentially unauthenticated users to make the server send HTTP requests to arbitrary destinations and access the responses.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65924 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65924.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-65924"
    },
    {
      "cve": "CVE-2026-65925",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        },
        {
          "category": "description",
          "text": "A vulnerability in JFrog Artifactory Cargo remote repositories allows users with read access to exploit the system to make unintended URL requests and retrieve their responses.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65925 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65925.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-65925"
    },
    {
      "cve": "CVE-2026-66014",
      "notes": [
        {
          "category": "description",
          "text": "JFrog Artifactory contains a vulnerability in its internal request authentication mechanism that may allow attackers to escalate privileges beyond intended levels under specific conditions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-66014 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-66014.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-66014"
    },
    {
      "cve": "CVE-2026-66015",
      "notes": [
        {
          "category": "description",
          "text": "An authenticated privilege-escalation vulnerability in JFrog Platform allows an admin-provisioned user to temporarily gain platform administrator access.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-66015 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-66015.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-66015"
    },
    {
      "cve": "CVE-2026-66018",
      "notes": [
        {
          "category": "description",
          "text": "Build readers with read access to a repository can access environment properties from another repository, potentially exposing confidential build environment secrets without impacting system integrity or availability.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-66018 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-66018.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-66018"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.