CVE-2026-66384
Authenticated users may write data outside the intended Docker cache path
KEVMEDIUM 5.3EPSS 0.7%
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
- Affected
- jfrog · artifactory
- CVSS v3.1 JFROG
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - EPSS
- 0.66% chance of exploitation in the next 30 days, 51st percentile
- CISA KEV
- added 2026-08-27
- Published
- 2026-08-12
- Updated
- 2026-08-28
Proof-of-concept exploits (1)
- HORKimhab/CVE-2026-663840★ · 2026-08-28
Security advisories
- https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories
- https://openai.com/index/hugging-face-incident-and-the-road-ahead