CVE-2026-66018: JFrog Artifactory Info Disclosure Flaw

CVE-2026-66018 Overview

CVE-2026-66018 is an information disclosure vulnerability in JFrog Artifactory. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build. This action exposes build environment secrets belonging to a repository the caller should not access.

The flaw is authenticated and network-exploitable with low complexity. It affects confidentiality only; integrity and availability are not impacted. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated users with read access to any ordinary repository can retrieve build environment secrets from protected builds in other repositories, undermining tenant isolation in Artifactory.

Affected Products

JFrog Artifactory (self-managed)
Deployments exposing build environment properties APIs
Instances with multi-repository access separation

Discovery Timeline

2026-07-27 - CVE-2026-66018 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66018

Vulnerability Analysis

The vulnerability resides in the Artifactory API path that returns environment properties associated with a build. When a caller requests environment properties, the endpoint accepts a repository parameter identifying the source of the build metadata. The authorization check validates the caller's read access to the parameter-supplied repository, not to the protected build's owning repository.

An attacker with read access to any ordinary repository can supply that repository as the parameter while targeting a protected build in a separate repository. The server returns environment properties belonging to the protected build. These properties frequently contain CI/CD secrets, tokens, and configuration values injected during build execution.

The issue is a broken access control condition that violates the isolation model between repositories. Exploitation requires only valid credentials and network reachability to the Artifactory instance.

Root Cause

The root cause is an authorization check that evaluates the wrong resource. The permission logic verifies read access on the repository referenced in the request parameter instead of the repository that owns the protected build. This confused-deputy pattern allows a lower-privileged repository read grant to substitute for the missing permission on the target build's repository.

Attack Vector

The attack vector is network-based and requires authenticated access with low privileges. The attacker issues an authenticated request to the build environment properties API, supplying a repository they can read and a build identifier from a protected repository. No user interaction is required. See the JFrog Security Advisories for endpoint specifics and fixed versions.

Detection Methods for CVE-2026-66018

Indicators of Compromise

Authenticated API calls to build environment properties endpoints where the requester lacks direct permission on the referenced build's repository.
Repeated environment property retrievals from a single principal across multiple unrelated repositories or builds.
Access log entries showing read of protected build metadata paired with an unrelated repository parameter.

Detection Strategies

Correlate Artifactory access logs against the permissions model to identify calls that succeeded despite missing target-repository authorization.
Baseline normal build metadata access patterns per user and alert on principals accessing builds outside their assigned projects.
Alert on API queries that mix a low-privilege repository parameter with build identifiers belonging to sensitive or protected repositories.

Monitoring Recommendations

Forward Artifactory request and audit logs to a central analytics platform for retention and cross-source correlation.
Monitor for spikes in api/build and environment properties endpoint usage by service accounts and interactive users.
Track secret exposure risk by inventorying which builds inject credentials into environment properties and prioritize alerting on those builds.

How to Mitigate CVE-2026-66018

Immediate Actions Required

Upgrade Artifactory to the fixed version listed in the JFrog Security Advisories.
Rotate any secrets, tokens, or credentials that may have been present in build environment properties on affected instances.
Review access logs for unauthorized environment property retrievals since the affected version was deployed.
Restrict read access on ordinary repositories to the minimum required set of users and service accounts.

Patch Information

JFrog has published fixed releases through its self-managed release channel. Refer to the JFrog Release Documentation for the specific fixed build numbers and upgrade guidance. Cloud-hosted Artifactory tenants should confirm remediation status with JFrog.

Workarounds

Remove or reduce read permissions on repositories used broadly across the organization until the patch is applied.
Avoid storing secrets in build environment properties; use an external secrets manager referenced at build time.
Restrict network access to the Artifactory API to trusted CI/CD networks and administrative subnets.

bash

# Configuration example
# Refer to JFrog documentation for exact configuration values
# https://docs.jfrog.com/releases/docs/jfrog-security-advisories