CVE-2026-66379: Puppet Information Disclosure Vulnerability

CVE-2026-66379 Overview

CVE-2026-66379 is a missing authorization vulnerability affecting JFrog Artifactory. An authenticated user can view private Puppet module metadata without holding read permissions on the underlying repository. The flaw maps to [CWE-862: Missing Authorization] and enables limited disclosure of information intended for privileged users.

The issue requires network access and low-privileged authentication. No user interaction is needed, and exploitation does not affect integrity or availability. Impact is limited to confidentiality of Puppet module metadata exposed through the Artifactory interface.

Critical Impact
Authenticated users can enumerate private Puppet module metadata across repositories they should not be able to read, leaking information about internal software components and infrastructure code.

Affected Products

JFrog Artifactory Self-Managed (versions listed in the vendor release notes)
JFrog Artifactory Cloud deployments hosting Puppet repositories
Artifactory instances configured with private Puppet module repositories

Discovery Timeline

2026-08-12 - CVE-2026-66379 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-66379

Vulnerability Analysis

The vulnerability resides in the authorization logic that governs access to Puppet module metadata endpoints in JFrog Artifactory. Artifactory exposes Puppet-specific APIs used by the puppet module client to search and describe modules. These endpoints should enforce the same repository-level read permissions as direct artifact access.

The metadata handler does not apply repository read checks before returning Puppet module details. An authenticated user with any valid session can query metadata for modules stored in private repositories they were never granted access to. Returned data may include module names, versions, author information, dependencies, and descriptions.

While the disclosed content is metadata rather than artifact contents, it exposes information about proprietary infrastructure code, internal naming conventions, and dependency graphs. This information supports downstream reconnaissance against continuous delivery pipelines.

Root Cause

The root cause is a missing authorization check on the Puppet module metadata path. Authentication is verified, but the code path skips the per-repository read permission validation that governs equivalent artifact retrieval APIs. This is a classic [CWE-862] broken access control condition.

Attack Vector

Exploitation requires network reachability to the Artifactory HTTP(S) endpoint and any authenticated Artifactory account. An attacker issues Puppet metadata queries against the affected endpoints and receives responses referencing modules stored in repositories where the account holds no read privilege. No elevated role, tokens, or social engineering steps are required.

No verified public exploit or proof-of-concept code was available at the time of publication. Refer to the JFrog Security Advisories for vendor technical details.

Detection Methods for CVE-2026-66379

Indicators of Compromise

Requests to Puppet module search or metadata endpoints (for example /api/puppet/*/v3/modules or /api/puppet/*/v3/releases) from user accounts that lack read entitlements on the referenced repositories.
Anomalous volume of Puppet metadata queries from a single authenticated principal enumerating multiple repositories in a short window.
Artifactory request logs showing HTTP 200 responses to Puppet metadata calls where the calling user has no explicit or effective read permission grant.

Detection Strategies

Correlate Artifactory access logs against the permission model to flag successful metadata reads by principals without matching repository read grants.
Baseline normal Puppet client behavior per user, then alert on breadth of repositories queried by a single account.
Ingest Artifactory audit and request logs into a SIEM and build detections for enumeration patterns targeting the Puppet API surface.

Monitoring Recommendations

Enable and forward Artifactory request, access, and audit logs to centralized log storage with retention sufficient for investigation.
Track authentication events for service accounts and human users that interact with Puppet repositories to identify credential misuse.
Review permission target configurations regularly to confirm private Puppet repositories are not implicitly reachable through shared includes or wildcard rules.

How to Mitigate CVE-2026-66379

Immediate Actions Required

Upgrade JFrog Artifactory to the fixed version identified in the JFrog Artifactory Release Notes.
Audit which authenticated users can currently reach the Artifactory API and revoke accounts that do not require Puppet repository access.
Review Puppet repository access logs for the past 90 days to identify prior unauthorized metadata reads.

Patch Information

JFrog has addressed CVE-2026-66379 in updated Artifactory releases. Consult the JFrog Security Advisories page for the specific fixed versions and cross-reference against the Artifactory Release Notes before scheduling the upgrade. Apply the patch to self-managed instances; JFrog Cloud tenants receive the fix through the standard cloud update schedule.

Workarounds

Restrict network access to Artifactory using firewalls or reverse proxies so only trusted CI/CD hosts and developer networks can authenticate.
Tighten Artifactory permission targets to remove broad anyAuthenticated grants and enforce least privilege on Puppet repositories.
Rotate access tokens for accounts that previously held broad authenticated access while the patch is scheduled.

bash

# Configuration example: restrict Puppet repository access to a specific group
# Apply via Artifactory REST API using an admin token
curl -u admin:$ADMIN_TOKEN -X PUT \
  -H "Content-Type: application/json" \
  "https://artifactory.example.com/artifactory/api/security/permissions/puppet-private-read" \
  -d '{
    "name": "puppet-private-read",
    "repo": {
      "repositories": ["puppet-private-local"],
      "actions": {
        "groups": {
          "puppet-authorized-users": ["read"]
        }
      }
    }
  }'