What’s Vulnerable › Vulnerabilities

CVE-2026-70550: Potential unauthorized access to private Composer repository metadata in JFrog Artifactory

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-25 · updated 2026-08-28
• Weakness: CWE-862

Description

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.

Affected products

• jfrog artifactory: from 7.161.0 before 7.161.19; from 7.146.0 before 7.146.29 — fixed in 7.146.29, 7.161.19

How to fix

Upgrade to a fixed version: jfrog artifactory 7.146.29, 7.161.19. Check the vendor advisory for mitigations.

References

• https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
• https://docs.jfrog.com/releases/docs/jfrog-security-advisories

Get alerted when CVE-2026-70550 or the next vulnerability affects your stack