Jfrog vulnerabilities
We track 17 vulnerabilities in Jfrog products across 3 products. 16 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on October 13, 2026.
Latest Jfrog vulnerabilities
- 9.0 Critical severity
jfrog-cli: Improper Neutralization of Argument Delimiters in a Command
Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
- 9.8 Critical severity
JFrog Artifactory Improper Authentication Exploited
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
- 7.6 High severity
artifactory: Missing Authorization
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.
- 7.5 High severity
JFrog Artifactory Improper Authentication Exploited
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
- 8.1 High severity
artifactory: Insufficient Verification of Data Authenticity
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
- 5.3 Medium severity
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Exploited
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
- 7.2 High severity
artifactory: Improper Privilege Management
An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access.
- 8.8 High severity
artifactory: Improper Authentication
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
- 8.8 High severity
artifactory: Improper Limitation of a Pathname to a Restricted Directory
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.
- 8.8 High severity
artifactory: Deserialization of Untrusted Data
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.
- 8.8 High severity
JFrog Artifactory Incorrect Authorization Exploited
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
- 9.3 Critical severity
JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23…
JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to cache poisoning.
- 9.0 Critical severity
An Improper input validation vulnerability that could potentially lead to privilege escalation…
An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system. This issue can also be exploi
- 8.8 High severity
JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted…
JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validati
- 7.5 High severity
Artifactory: Improper Handling of Exceptional Conditions
JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.
- 9.8 Critical severity
JFrog Artifactory: Improper Privilege Management
JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user.
- 8.8 High severity
JFrog Artifactory: Deserialization of Untrusted Data
JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due t