jfrog has 9 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 2 in the 90 before. The busiest recent month was August 2026 with 6. The median CVSS is 8.1 (high), with 1 rated critical. 22% have been exploited in the wild — well above the 1% corpus average, so jfrog flaws are worth patching on sight. Most affected products: artifactory (8), jfrog-cli (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 22% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —(2)
- Last 90 days
- 7 prev 2
Worst active — by depth score
CVE-2026-42016High· 8.1Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation71CVE-2026-42018High· 7.5JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.68CVE-2026-92892Critical· 9.0Potential arbitrary code execution, under specific configurations.50CVE-2026-69106High· 8.8A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.49CVE-2026-66014High· 8.8JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.49
jfrog vulnerabilities
CVEs affecting jfrog, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-92892Critical· 9.0Potential arbitrary code execution, under specific configurations.
Potential arbitrary code execution, under specific configurations.
CVE-2026-42018High· 7.5CISA KEVPoCJFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVE-2026-69106High· 8.8A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
CVE-2026-70547Medium· 4.3An authenticated user without repository read permission may access package metadata under specific conditions.
An authenticated user without repository read permission may access package metadata under specific conditions.
CVE-2026-69107Medium· 5.9An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
CVE-2026-69105High· 8.1An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
CVE-2026-66016Medium· 6.7Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
CVE-2026-66014High· 8.8JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
CVE-2026-42016High· 8.1CISA KEVPoCIncorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.