{"id":"CVE-2026-66384","kind":"vulnerability","aliases":["CVE-2026-66384"],"related":[],"title":"jfrog artifactory: An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions","description":"JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"JFrog Artifactory (self-managed) path traversal (CWE-22): an authenticated user can write data outside the intended Docker cache path under specific remote-repository conditions. Integrity impact only (vendor CVSS 5.3), but CISA KEV lists it as exploited in the wild. Fixed in 7.146.35 and 7.161.16.","severity":"high","cvss":5.3,"epss":null,"exploited":true,"exploited_at":"2026-08-27T00:00:00+00:00","products":[{"name":"JFrog Artifactory","fixed":["7.146.35","7.161.16"],"affected":"< 7.146.35; >= 7.161.0, < 7.161.16","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.146.35"],"affected":"< 7.146.35","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.161.16"],"affected":">= 7.161.0, < 7.161.16","ecosystem":"vendor"},{"name":"JFrog Artifactory","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["docker","exploited","jfrog-artifactory","self-hosted","vendor"],"not_affected_if":["managed-hosting","no-docker-remote-repos"],"how_to_check":"Check your Artifactory version (UI: Administration > Platform > Version, or GET /artifactory/api/system/version). Exposed if it is below 7.146.35, or between 7.161.0 and 7.161.15, and you have Docker remote repositories (Administration > Repositories > Remote, package type Docker) that authenticated users can reach. Review the server for unexpected files outside the Docker cache directory, per CISA's forensics triage requirement.","fix":"Upgrade to 7.146.35 or later on the 7.146 line, or 7.161.16 or later on the 7.161 line (older lines must move to one of these). JFrog names no workaround; CISA says to discontinue use if mitigations are unavailable. Review for compromise too, since it is exploited.","status":"open","published_at":"2026-08-12T16:17:14+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:47+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:31:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch from JFrog per CISA BOD 26-04 guidance; the sources do not name a fixed version. If no mitigation is available, CISA says to discontinue use of the product.","summary":"JFrog Artifactory has a path traversal flaw that lets an authenticated user write files outside the intended Docker cache path when certain remote-repository conditions are met. CISA lists it as actively exploited in the wild, so the write can be used to plant or overwrite files on the server.","category":"vendor","who_cares":["jfrog-artifactory","self-hosted","docker"],"confidence":0.6,"analyst_note":"Find JFrog's advisory for CVE-2026-66384 to get affected and fixed versions, the exact remote-repository conditions, and a check for exposure; the KEV entry only gives the CISA summary.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-docker-remote-repos"],"severity_if_unknown":"high"},"cost_usd":0.0004,"input_tokens":2227,"output_tokens":354,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find JFrog's advisory for CVE-2026-66384 to get affected and fixed versions, the exact remote-repository conditions, and a check for exposure; the KEV entry only gives the CISA summary.","search":"'-04':144C,170C,201C '-2026':22A,25A '-22':52B '-66384':23A,26A '26':143C,169C,200C '5.3':76B '7.146.35':89B '7.161.16':91B 'accord':133C 'action':129C 'adher':197C 'allow':108C 'appli':130C 'applic':167C 'artifactori':2A,39B,45B,93C 'artifactory':28A,30A,32A,34A 'asset':191C 'authent':4A,54B,110C 'base':148C 'bod':142C,168C,199C 'cach':13A,63B,119C 'cisa':78B,127C,140C,157C 'cloud':173C 'complianc':138C 'condit':20A,70B,126C 'contain':94C 'cve':21A,24A 'cvss':75B 'cwe':51B 'data':8A,58B,114C 'directori':104C 'discontinu':176C 'docker':12A,35B,62B,118C 'ensur':137C,196C 'evalu':189C 'exploit':36B,83B 'exposur':194C 'fix':87B 'follow':166C 'forens':159C 'guidanc':155C,171C 'guidelin':203C 'host':42B 'impact':72B 'improp':96C 'instruct':136C 'integr':71B 'intend':11A,61B,117C 'internet':193C 'jfrog':1A,27A,29A,31A,33A,38B,44B,92C 'jfrog-artifactori':37B 'kev':79B 'limit':97C 'list':80B 'manag':48B 'may':6A 'mitig':131C,182C 'note':154C,165C 'outsid':9A,59B,115C 'patch':202C 'path':14A,49B,64B,120C 'pathnam':100C 'priorit':145C 'product':180C 'remot':18A,68B,124C 'remote-repositori':17A,67B,123C 'repositori':19A,69B,125C 'requir':128C,161C 'respons':187C 'restrict':103C 'risk':150C 'secur':146C 'see':151C,162C 'self':41B,47B 'self-host':40B 'self-manag':46B 'servic':174C 'specif':16A,66B,122C 'stakehold':185C 'travers':50B 'triag':160C 'unavail':184C 'updat':147C 'url':152C,163C 'use':177C 'user':5A,55B,111C 'vendor':43B,74B,135C 'vulner':105C 'wild':86B 'write':7A,57B,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-12T16:17:14+00:00","kev":{"dateAdded":"2026-08-27","dueDate":"2026-09-10","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"reefs@jfrog.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-66384","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384","severity":null,"published_at":"2026-08-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-66384:126","url":null,"severity":null,"published_at":"2026-10-23T21:40:19+00:00","modified_at":"2026-10-23T21:40:19+00:00","first_seen_at":"2026-10-23T21:40:19+00:00","fetched_at":"2026-10-23T21:40:19+00:00","note":"JFrog advisory table + CVE record (JFrog CNA): affected <7.146.35 and 7.161.0-7.161.16; fixed 7.146.35 / 7.161.16. KEV-listed 2026-08-27; no public PoC or X chatter found. Exact remote-repo trigger not published by JFrog. Older lines (7.133, 7.125, 7.117, 7.111) listed under '<7.146.35' with no backport version, so move to 7.146.35+ or 7.161.16+. Finder: Kostya Kortchinsky (OpenAI). CVSS 5.3 medium by vendor, but exploited so severity stays high."},{"source":"nvd","external_id":"CVE-2026-66384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66384","severity":null,"published_at":"2026-08-12T16:17:14+00:00","modified_at":"2026-10-23T20:10:00+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1051,"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","title":"JFrog Security Advisories (CVE-2026-66384: <7.146.35; 7.161.0-7.161.16)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1180,"url":"https://www.cve.org/CVERecord?id=CVE-2026-66384","title":"CVE Record CVE-2026-66384 (JFrog CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}