JFrog Artifactory Path Traversal Vulnerability (CVE-2026-66384)

Technical Analysis

CVE-2026-66384 is an improper limitation of a pathname to a restricted directory (CWE-22, path traversal) vulnerability in JFrog Artifactory, exploitable by an authenticated user to write data outside the intended Docker cache path when specific remote-repository configurations are in use. This could allow an attacker to overwrite arbitrary files on the Artifactory host, potentially leading to cache poisoning, malicious artifact injection, or remote code execution depending on which files are overwritten. Because Artifactory is frequently used as the backing package/container registry for CI/CD pipelines and internal software supply chains, successful exploitation could enable an attacker to plant malicious packages or images that are later pulled by downstream build systems. Organizations that use Artifactory to host or proxy Python, npm, or container packages consumed by AI agent frameworks, RAG pipelines, or LLM tool-use environments are at risk of supply-chain compromise if a poisoned dependency or agent runtime image is silently substituted, potentially leading to code execution within agent hosts.

Affected Systems

JFrog Artifactory instances configured with remote Docker repositories using vulnerable caching configurations; specific affected version ranges should be confirmed via JFrog's official security advisory for CVE-2026-66384.

Indicators of Compromise

• No specific IOCs (hashes, IPs, domains) published at this time; monitor JFrog and CISA KEV advisories for updates.

Remediation Steps

1. 1

   Apply vendor patch

   Upgrade Artifactory to the version specified in JFrog's security advisory that resolves CVE-2026-66384.

2. 2

   Review remote repository configurations

   Audit Docker remote-repository and cache path configurations for unusual or unauthorized changes.

3. 3

   Restrict authenticated access

   Limit and audit which users/service accounts have write access to Artifactory repositories, applying least privilege.

4. 4

   Validate artifact integrity

   Verify checksums/signatures of cached Docker images and packages pulled from Artifactory, especially those consumed by CI/CD and agent build pipelines.

5. 5

   Monitor for anomalous file writes

   Enable logging/alerting on filesystem writes outside expected cache directories on Artifactory hosts.

6. 6

   Meet CISA KEV deadline

   Federal agencies and recommended organizations should remediate by the September 10, 2026 due date per CISA KEV guidance.