Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-66018

JFrog Artifactory build environment properties exposure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
JFROG

Description

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets (confidentiality impact; no integrity or availability impact demonstrated).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jfrog artifactory

Default version status: unaffected

  • 7.146.0 to < 7.146.34affected
  • 7.161.0 to < 7.161.15affected

References