CVE-2026-66381: Path Traversal Vulnerability

CVE-2026-66381 Overview

CVE-2026-66381 is a path traversal vulnerability [CWE-22] affecting JFrog Artifactory. A repository reader granted the cache-deploy permission can access content located outside a configured upstream repository path under specific conditions. The flaw stems from insufficient validation of path boundaries when the cache-deploy permission is evaluated against upstream repository content.

Exploitation requires an authenticated account with reader privileges and the cache-deploy permission. The attack is network-based but carries high attack complexity, limiting broad exploitation. Successful exploitation exposes repository content that should remain isolated within the configured upstream path.

Critical Impact
An authenticated repository reader with cache-deploy permission can read content outside the configured upstream path, resulting in confidentiality loss for artifacts intended to be inaccessible.

Affected Products

JFrog Artifactory (self-managed) — specific fixed versions listed in JFrog security advisories
Deployments using repositories with cache-deploy permissions assigned to readers
Artifactory instances exposing remote or virtual repositories with upstream path configurations

Discovery Timeline

2026-08-12 - CVE-2026-66381 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-66381

Vulnerability Analysis

The vulnerability is classified as an improper limitation of a pathname to a restricted directory, commonly referred to as path traversal [CWE-22]. Artifactory permits repository readers holding the cache-deploy permission to interact with cached upstream content. Under specific conditions, the permission check does not fully constrain requests to the configured upstream path.

An authenticated user with reader-plus-cache-deploy permissions can request paths that resolve outside the intended upstream directory. The result is unauthorized read access to artifacts or metadata that fall outside the boundary the administrator intended to expose. Integrity and availability are not affected; only confidentiality is impacted.

Exploitation carries high attack complexity, indicating that specific repository configurations or timing conditions must be present. No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is insufficient canonicalization or boundary enforcement of upstream paths when the cache-deploy permission is evaluated. The authorization layer trusts request-supplied path components without fully constraining them to the configured upstream root, allowing traversal outside the intended scope.

Attack Vector

The attack vector is network-based and requires authenticated access with the cache-deploy permission on a target repository. An attacker crafts requests referencing paths that resolve outside the configured upstream path. See the JFrog Security Advisories for advisory-specific reproduction conditions.

No verified public exploitation code is available for CVE-2026-66381. Refer to vendor advisories for authoritative technical detail.

Detection Methods for CVE-2026-66381

Indicators of Compromise

Repository access log entries from reader accounts requesting paths containing traversal sequences such as ../ against remote or virtual repositories.
Unexpected artifact downloads by accounts holding both reader and cache-deploy permissions on repositories with upstream path restrictions.
Access log entries where the resolved artifact path falls outside the configured upstream root of a remote repository.

Detection Strategies

Audit Artifactory permission targets to enumerate all users and groups holding the cache-deploy permission alongside reader roles.
Review Artifactory request logs for path patterns that traverse upward from the configured upstream root of remote repositories.
Correlate authentication events with repository access to identify low-privilege accounts issuing unusual volumes of cache-deploy requests.

Monitoring Recommendations

Forward Artifactory access, request, and audit logs to a centralized log management or SIEM platform for continuous review.
Alert on repository access from accounts that recently gained the cache-deploy permission or whose access patterns deviate from baseline.
Track download activity from remote repository caches to identify artifacts being retrieved outside expected upstream paths.

How to Mitigate CVE-2026-66381

Immediate Actions Required

Upgrade JFrog Artifactory to the fixed version identified in the JFrog Security Advisories.
Inventory all permission targets that grant cache-deploy alongside reader permissions and remove the combination where not required.
Review remote repository upstream path configurations and confirm the scope of exposed content matches intent.

Patch Information

JFrog has published fixed versions of Artifactory. Consult the JFrog Release Documentation for release notes and the JFrog Security Advisories for advisory-specific fixed version numbers.

Workarounds

Revoke the cache-deploy permission from reader-role users and groups until the patch is applied.
Restrict remote repository access to trusted authenticated principals through additional network or reverse-proxy controls.
Segment sensitive artifacts into separate repositories that do not share upstream paths with less-trusted repositories.

bash

# Configuration example
# Enumerate permission targets and their principals via the Artifactory REST API
curl -u "$ADMIN_USER:$ADMIN_TOKEN" \
  -X GET "https://artifactory.example.com/artifactory/api/security/permissions"

# Retrieve a specific permission target to inspect assigned actions such as cache-deploy
curl -u "$ADMIN_USER:$ADMIN_TOKEN" \
  -X GET "https://artifactory.example.com/artifactory/api/security/permissions/<permission-target-name>"