CVE-2026-66378: NuGet Information Disclosure Vulnerability

CVE-2026-66378 Overview

CVE-2026-66378 is a missing authorization vulnerability [CWE-862] affecting JFrog Artifactory. An authenticated user without repository read permission may access private NuGet metadata under specific conditions. The flaw exposes package metadata that should be restricted to users holding explicit read entitlements on the target repository.

The issue requires valid authentication but no elevated privileges, and it can be triggered over the network without user interaction. Exploitation results in limited confidentiality impact restricted to NuGet metadata, with no integrity or availability consequences.

Critical Impact
Authenticated users without repository read permission can enumerate private NuGet package metadata, potentially exposing internal package names, versions, and dependency information to unauthorized parties.

Affected Products

JFrog Artifactory Self-Managed (NuGet repository handler)
JFrog Artifactory Cloud instances hosting private NuGet repositories
Deployments relying on NuGet repository-level access controls

Discovery Timeline

2026-08-12 - CVE-2026-66378 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-66378

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw [CWE-862] in the NuGet repository handling logic of JFrog Artifactory. Standard authorization checks apply to package downloads and repository browsing. However, specific NuGet metadata endpoints do not enforce the same repository read permission verification.

An authenticated user with any valid credentials can query these endpoints against a private repository. The server returns metadata responses even when the caller lacks read entitlement on the target repository. Disclosed data is limited to NuGet package metadata rather than package binaries or credentials.

Root Cause

The root cause is an authorization gap in the request-handling path for certain NuGet metadata operations. Authentication succeeds and the request proceeds without validating that the caller holds repository-level read permission. This constitutes a broken access control condition where the authorization decision is either absent or applied inconsistently across NuGet endpoints.

Attack Vector

Exploitation requires network access to the Artifactory instance and a valid low-privileged account. The attacker issues crafted requests to NuGet metadata endpoints referencing a private repository they do not have permission to read. The server returns metadata that should be restricted, allowing enumeration of package names, versions, and related attributes.

No verified public proof-of-concept code is currently available. Technical details are limited to the vendor advisory. Consult the JFrog Security Advisories for endpoint specifics.

Detection Methods for CVE-2026-66378

Indicators of Compromise

Authenticated HTTP requests to NuGet metadata endpoints from accounts lacking documented read permission on the target repository.
Anomalous enumeration patterns across multiple private NuGet repositories originating from a single user or token.
Access log entries returning 200 OK for metadata requests where the requesting principal has no repository entitlement.

Detection Strategies

Correlate Artifactory access logs with permission-target assignments to flag metadata reads by principals without matching read permission.
Baseline normal NuGet metadata request volume per user and alert on statistical deviations indicative of enumeration.
Review audit logs for repeated NuGet API calls referencing repositories outside a user's assigned project scope.

Monitoring Recommendations

Forward Artifactory access.log and request.log to a centralized SIEM for continuous review of NuGet endpoint activity.
Monitor low-privileged service accounts and CI tokens for unexpected NuGet metadata queries against private repositories.
Track cross-repository access patterns and generate alerts when a single principal touches unusual numbers of private NuGet repositories.

How to Mitigate CVE-2026-66378

Immediate Actions Required

Upgrade JFrog Artifactory to a fixed release identified in the vendor security advisory as remediating CVE-2026-66378.
Audit existing NuGet repository permissions and remove unnecessary authenticated access from anonymous or broad-scope roles.
Rotate long-lived API tokens and CI credentials that may have been used to query private NuGet metadata without authorization.

Patch Information

JFrog has published patched versions through its self-managed release channel. Refer to the JFrog Release Documentation for the fixed version corresponding to your deployment tier and to the JFrog Security Advisories for the specific advisory covering CVE-2026-66378.

Workarounds

Restrict network access to Artifactory NuGet endpoints using perimeter controls or reverse proxy rules where feasible.
Enforce the principle of least privilege on NuGet repositories and remove authenticated group defaults that grant unnecessary access.
Disable or gate anonymous authentication paths that could allow low-friction credential provisioning to unauthorized users.

bash

# Example: audit users granted access to a NuGet repository via the Artifactory REST API
curl -u admin:$ARTIFACTORY_TOKEN \
  -X GET "https://artifactory.example.com/artifactory/api/repositories/<nuget-repo-key>" \
  -H "Content-Type: application/json"

# List permission targets referencing the repository
curl -u admin:$ARTIFACTORY_TOKEN \
  -X GET "https://artifactory.example.com/artifactory/api/security/permissions"