CVE-2026-66384: medium-severity vulnerability in jfrog artifactory
Authenticated users may write data outside the intended Docker cache path
Published · Updated
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
A logged-in user can save files outside where Docker is supposed to store cache data when using certain remote repositories. This could allow them to write files to unintended locations on the system.
Authenticated users can exploit path traversal (CWE-22) to write data outside the designated Docker cache directory under specific remote-repository configurations. The vulnerability requires valid authentication and specific repository conditions, with impact limited to unauthorized file write operations in unintended system locations.
In the same product, most dangerous first.