CVE-2026-70550: JFrog Artifactory Information Disclosure

CVE-2026-70550 Overview

CVE-2026-70550 is a missing authorization vulnerability [CWE-862] in JFrog Artifactory Composer repository handling. An authenticated user can, under specific conditions, read package metadata from Composer repositories they are not authorized to access. The flaw affects confidentiality only and has been resolved in fixed Artifactory releases. JFrog documents the issue in the Artifactory security advisories.

Critical Impact
Authenticated attackers with low privileges can retrieve package metadata from Composer repositories outside their authorization scope, exposing internal package names, versions, and dependency information.

Affected Products

JFrog Artifactory (self-managed) versions prior to the fixed release
Artifactory deployments exposing Composer (PHP) repositories
Multi-tenant Artifactory instances where repository-level access controls are enforced

Discovery Timeline

2026-08-25 - CVE-2026-70550 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-70550

Vulnerability Analysis

The vulnerability resides in how JFrog Artifactory enforces authorization for Composer repository requests. Composer is the dependency manager for PHP, and Artifactory acts as a proxy or hosted registry for composer.json and package metadata endpoints. Under specific request conditions, the Composer handler returns package metadata without validating that the requesting user holds read permission on the target repository.

The result is a confidentiality breach limited to package metadata. Attackers do not gain write access, cannot alter integrity, and cannot degrade availability through this flaw. Exposed metadata can still support downstream attacks. Internal package names, version strings, and dependency graphs frequently reveal information about proprietary software, third-party integrations, and internal service topology.

Root Cause

The root cause is a missing authorization check [CWE-862] on the Composer repository metadata code path. The handler resolves the requested repository and returns metadata before the repository-level access control decision is applied for that request pattern. Authenticated sessions therefore bypass the tenant boundary that Artifactory otherwise enforces on package repositories.

Attack Vector

Exploitation requires network access to the Artifactory instance and valid authenticated credentials with low privileges. No user interaction is required. An attacker enumerates known or guessed Composer repository names and issues metadata requests against those repositories through the standard Composer API surface. Repositories the attacker should not see return their metadata under the vulnerable conditions.

No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities Catalog entry is associated with this CVE at publication.

Detection Methods for CVE-2026-70550

Indicators of Compromise

Authenticated Composer metadata requests from a single principal spanning many distinct repository names, indicating enumeration.
HTTP 200 responses to Composer packages.json or provider metadata endpoints for repositories outside the caller's expected project scope.
Access log entries from service accounts or CI tokens reading Composer repositories that are not part of their normal build set.

Detection Strategies

Baseline each authenticated principal's normal set of Composer repositories and alert on first-time reads of repositories outside that baseline.
Correlate Artifactory request.log entries against the permission target model to flag successful reads by users lacking explicit repository grants.
Hunt for high-rate iteration over Composer repository path prefixes from a single token or session.

Monitoring Recommendations

Forward Artifactory access, request, and audit logs to a centralized analytics pipeline for retention and query.
Enable per-repository read auditing on Composer repositories that contain internal or sensitive packages.
Track anomalous growth in unique repository names accessed per user over rolling time windows.

How to Mitigate CVE-2026-70550

Immediate Actions Required

Upgrade JFrog Artifactory to a fixed version as identified in the JFrog Artifactory Release Notes and JFrog Security Advisories Documentation.
Review Composer repository permission targets and remove unnecessary broad grants to authenticated user groups.
Rotate long-lived API keys, access tokens, and identity tokens that may have been exposed to untrusted networks.

Patch Information

JFrog has addressed the issue in fixed Artifactory releases. Consult the vendor release notes and security advisories for the exact fixed version applicable to your deployment channel, and validate the upgrade in a staging environment before production rollout.

Workarounds

Restrict authenticated access to the Artifactory UI and REST API to trusted networks using a reverse proxy or network ACL until patched.
Temporarily disable or restrict Composer repositories that contain sensitive internal package metadata.
Enforce least-privilege permission targets so that no group holds implicit read on Composer repositories it does not require.

bash

# Configuration example
# Verify installed Artifactory version before and after upgrade
curl -u <admin>:<token> https://<artifactory-host>/artifactory/api/system/version