CVE-2026-69105 PUBLISHED

Potential package cache integrity issue in JFrog Artifactory

Assigner: JFROG
Reserved: 03.08.2026 Published: 12.08.2026 Updated: 12.08.2026

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS Score: 8.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	jfrog
Product	artifactory
Versions	Default: unaffected affected from 7.161.0 to 7.161.16 (excl.)

Credits

Kostya Kortchinsky | OpenAI finder

References

https://docs.jfrog.com/releases/docs/jfrog-security-advisories
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

Problem Types

CWE-345 Insufficient Verification of Data Authenticity CWE