CVE-2026-66375: Privilege Escalation Vulnerability

CVE-2026-66375 is a privilege escalation vulnerability that allows low-privilege authenticated users to permanently remove protected internal metadata across repositories under specific conditions. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-66375 Overview

CVE-2026-66375 is a missing authorization vulnerability [CWE-862] that allows a low-privilege authenticated user to permanently remove protected internal metadata across repositories under specific conditions. The flaw affects JFrog Artifactory deployments and stems from insufficient authorization checks on metadata deletion operations. Because the impacted metadata is repository-internal and protected under normal permission models, its removal can disrupt artifact integrity, provenance tracking, and downstream build reliability. Exploitation requires only network access and standard user credentials, with no user interaction needed.

Critical Impact
An authenticated user with minimal privileges can irreversibly destroy protected internal metadata across multiple repositories, impacting artifact integrity and availability.

Affected Products

JFrog Artifactory Self-Managed (see vendor releases guide for affected versions)
JFrog Artifactory Cloud (per vendor advisory guidance)
Deployments relying on repository-internal metadata for artifact governance

Discovery Timeline

2026-08-12 - CVE-2026-66375 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-66375

Vulnerability Analysis

The vulnerability is a broken access control issue in the metadata management layer of JFrog Artifactory. Under specific operational conditions, the platform fails to verify that the calling identity holds sufficient privileges to delete protected internal metadata. A low-privilege authenticated user can therefore issue metadata removal operations that should be restricted to administrative roles.

The deletions are permanent and cross repository boundaries. This means a single low-privileged account can affect metadata associated with artifacts owned by other teams or projects. The resulting loss disrupts artifact resolution, dependency tracking, and audit trails used by downstream build systems.

Root Cause

The root cause is a missing authorization check [CWE-862] on a metadata mutation code path. The service accepts and processes deletion requests without validating whether the authenticated principal has the required repository-level or system-level permission for the targeted metadata objects.

Attack Vector

An attacker requires network reachability to the Artifactory API and valid credentials for any low-privileged account. No user interaction is required. The attacker authenticates, identifies the vulnerable metadata operation, and submits requests targeting protected internal metadata across accessible repositories. The vulnerability does not disclose data confidentiality but severely impacts integrity and availability of the metadata store.

Refer to the JFrog Security Advisories Overview for authoritative technical details.

Detection Methods for CVE-2026-66375

Indicators of Compromise

Unexpected deletion events in Artifactory audit logs referencing internal metadata objects performed by non-administrative accounts.
Sudden gaps in artifact provenance, checksum records, or repository index data across multiple repositories.
API request patterns from a single low-privilege user targeting metadata endpoints across repositories they do not own.

Detection Strategies

Review Artifactory access and request logs for metadata DELETE operations initiated by users lacking administrative roles.
Correlate authentication events with metadata mutation events to identify low-privilege sessions performing bulk deletions.
Baseline normal metadata operation volumes per user and alert on statistical deviations.

Monitoring Recommendations

Forward Artifactory audit logs to a centralized logging or SIEM platform and retain them for forensic review.
Enable alerting on any metadata deletion where the actor's role does not match the target repository's expected administrative principals.
Monitor build pipeline failures and artifact resolution errors as secondary indicators of metadata tampering.

How to Mitigate CVE-2026-66375

Immediate Actions Required

Upgrade JFrog Artifactory to a fixed release per the JFrog Artifactory Releases Guide.
Audit user and group permissions and remove standing low-privilege accounts that no longer require access.
Rotate API keys and access tokens for accounts that could reach vulnerable metadata endpoints.

Patch Information

JFrog has published guidance for affected releases. Administrators should consult the JFrog Security Advisories Overview and apply the vendor-recommended fixed version for their deployment channel. Self-managed customers should follow the upgrade path documented in the releases guide; cloud tenants should confirm remediation status with vendor communications.

Workarounds

Restrict network access to Artifactory management and API endpoints to trusted administrative networks until patching is complete.
Temporarily reduce the number of accounts with authenticated access to production repositories to minimize the exploitable population.
Take verified backups of repository metadata to enable recovery if unauthorized deletion occurs prior to patch deployment.

bash

# Configuration example: review recent metadata deletion events via the Artifactory REST API
curl -u "$ADMIN_USER:$ADMIN_TOKEN" \
  "https://artifactory.example.com/artifactory/api/search/dates?from=$(date -d '7 days ago' +%s)000&dateFields=deleted"