CVE-2026-69106

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases	Release Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Un usuario de bajo privilegio puede envenenar los metadatos de artefactos en caché bajo condiciones específicas, causyo potencialmente que los consumidores recuperen contenido no confiable.

Information

Published : 2026-08-12 18:18

Updated : 2026-10-24 16:10

NVD link : CVE-2026-69106

Mitre link : CVE-2026-69106

CVE.ORG link : CVE-2026-69106

JSON object : View

Products Affected

jfrog

artifactory

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-69106", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69106", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T15:04:07.356444Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "reefs@jfrog.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "reefs@jfrog.com", "affectedData": [{"vendor": "jfrog", "product": "artifactory", "versions": [{"status": "affected", "version": "0", "lessThan": "7.146.28", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T18:18:11.273", "references": [{"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "tags": ["Release Notes"], "source": "reefs@jfrog.com"}, {"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "tags": ["Vendor Advisory"], "source": "reefs@jfrog.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "reefs@jfrog.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content."}, {"lang": "es", "value": "Un usuario de bajo privilegio puede envenenar los metadatos de artefactos en cach\u00e9 bajo condiciones espec\u00edficas, causyo potencialmente que los consumidores recuperen contenido no confiable."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6F083F4-DDB7-49B2-891F-DDDFF81FE498", "versionEndExcluding": "7.146.28"}], "operator": "OR"}]}], "sourceIdentifier": "reefs@jfrog.com"}