CVE-2026-66384: Docker Path Traversal Vulnerability

CVE-2026-66384 Overview

CVE-2026-66384 is a path traversal vulnerability [CWE-22] affecting JFrog Artifactory. An authenticated user can write data outside the intended Docker cache path when specific remote-repository conditions are met. The flaw allows integrity-impacting file writes to arbitrary locations that the Artifactory process can access.

Exploitation requires valid credentials and depends on remote-repository configuration state. The issue does not directly expose confidential data or degrade availability, but it undermines the integrity of files on the Artifactory server. Successful abuse can enable staging of malicious artifacts in unintended directories.

Critical Impact
An authenticated attacker can write files outside the Docker cache directory, corrupting server state or planting content in sensitive filesystem locations.

Affected Products

JFrog Artifactory Self-Managed (versions listed in vendor release notes)
JFrog Artifactory Cloud (per vendor security advisories)
Deployments with configured Docker remote repositories

Discovery Timeline

2026-08-12 - CVE-2026-66384 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-66384

Vulnerability Analysis

The vulnerability resides in how JFrog Artifactory handles path construction for cached Docker artifacts pulled through remote repositories. When Artifactory proxies a Docker registry, it stores fetched layers and manifests inside a designated cache directory tied to the remote repository configuration.

Under specific remote-repository conditions, input used to derive the cache path is not sufficiently normalized against traversal sequences. An authenticated user with permission to interact with the remote repository can influence the write path so that files land outside the intended cache root. The consequence is an integrity impact on the Artifactory host filesystem.

Because the flaw requires authentication, elevated remote-repository state, and a non-trivial attack complexity, exploitation is bounded. However, in shared-tenant environments with many authenticated developers, the practical attack surface is broader than the access controls suggest.

Root Cause

The root cause is insufficient sanitization of path components used when writing Docker cache entries [CWE-22]. Traversal characters and relative segments are not fully stripped or rejected before the write operation resolves the final destination on disk.

Attack Vector

The attack is network-based and requires low-privilege authenticated access. The attacker interacts with a Docker remote repository whose configuration triggers the vulnerable code path. Specially crafted repository or artifact identifiers cause the cache write routine to resolve to a location outside the cache root. Refer to the JFrog Security Advisory List for the vendor's technical description.

No verified public exploit code is available at the time of publication.

Detection Methods for CVE-2026-66384

Indicators of Compromise

Unexpected files appearing outside the configured Artifactory Docker cache directory, particularly containing path segments such as .. in source requests.
Artifactory access logs showing authenticated Docker pull or push requests against remote repositories with unusual repository or tag names containing encoded traversal sequences.
Filesystem modifications by the Artifactory service account in directories unrelated to repository storage.

Detection Strategies

Audit Artifactory request logs for Docker API calls whose path parameters contain %2e%2e, ..%2f, or literal ../ sequences.
Compare cache directory inventory against expected repository layout to identify files written outside docker-remote-cache subtrees.
Correlate authenticated user actions on remote Docker repositories with subsequent unexpected filesystem writes on the Artifactory host.

Monitoring Recommendations

Enable file integrity monitoring on the Artifactory installation, data, and configuration directories.
Forward Artifactory request and access logs to a centralized logging platform for pattern-based alerting.
Alert on authenticated users creating or modifying remote Docker repository definitions outside of change-management windows.

How to Mitigate CVE-2026-66384

Immediate Actions Required

Upgrade JFrog Artifactory to a fixed release identified in the JFrog Artifactory Release Notes.
Review and restrict which authenticated users can create or modify Docker remote repository configurations.
Rotate credentials for accounts with permission to interact with Docker remote repositories if abuse is suspected.

Patch Information

JFrog has addressed the issue in updated Artifactory releases. Consult the JFrog Security Advisory List for the exact fixed versions applicable to self-managed and cloud deployments, then apply the upgrade following the vendor's standard procedure.

Workarounds

Restrict Docker remote repository management permissions to a minimal set of trusted administrators.
Disable or remove unused Docker remote repositories that are not required for production workflows.
Enforce least-privilege filesystem permissions on the Artifactory service account so writes outside the cache root are rejected by the operating system.

bash

# Configuration example: restrict Artifactory service account filesystem scope
# Ensure the service account only has write access to designated Artifactory data paths
chown -R artifactory:artifactory /var/opt/jfrog/artifactory/data
chmod -R 750 /var/opt/jfrog/artifactory/data
# Remove write permissions from directories outside the Artifactory data root
find / -user artifactory -not -path "/var/opt/jfrog/*" -not -path "/opt/jfrog/*" -exec ls -ld {} \;