CVE-2026-66384
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
Description
CVE-2026-66384 is a medium-severity path traversal vulnerability in JFrog Artifactory in which an authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. Because Artifactory's Docker cache holds container image layers that downstream builds and production deployments pull automatically, a write outside the intended directory turns an ordinary repository user into someone who can place content where the platform did not intend it to go. Artifactory is affected before 7.146.35 and, on the 7.161 line, before 7.161.16. Although CVE-2026-66384 is scored at only 5.3, it is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is referenced in OpenAI's public technical report on the Hugging Face incident, which places this path traversal vulnerability in a real, documented supply-chain compromise.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jfrog | artifactory | < 7.146.35; >= 7.161.0, < 7.161.16 |
References
- https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases(Release Notes, Vendor Advisory)
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories(Vendor Advisory)
- https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf(Technical Description)
- https://openai.com/index/hugging-face-incident-and-the-road-ahead/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path traversal occurs when software builds a pathname from external input intended to stay under a restricted parent directory, but fails to neutralise special elements such as .. and / that let the resolved path escape it. In CVE-2026-66384 path components derived from remote-repository data reach Artifactory's Docker cache write logic without sufficient confinement, so under specific conditions an authenticated user can cause data to be written outside the intended cache directory.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2026-66384 is remotely exploitable over the network but carries High attack complexity and requires low privileges — an authenticated Artifactory user plus the "specific remote-repository conditions" the vendor describes, which means the attacker cannot simply fire a request and succeed. The impact profile is unusual and worth reading carefully: integrity impact is High while confidentiality and availability are unaffected, so this is purely a write primitive. Nothing is disclosed and nothing is taken down; instead, attacker-controlled data lands at a path the platform did not intend, which in an artifact repository means the possibility of planting or replacing content that downstream consumers trust implicitly. That is precisely why a 5.3 base score understates the operational risk: the CVSS metrics measure the direct technical effect, not the supply-chain leverage of writing into a system whose entire purpose is to distribute binaries. The EPSS score of roughly 0.6% (46th percentile) is similarly unrepresentative — CISA's KEV listing and OpenAI's incident report both establish that this vulnerability has been used in practice.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-66384 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 10 September 2026 that has already passed. The most substantive public evidence is not an exploit release but an incident report: OpenAI published a technical report on the Hugging Face incident and a companion post that reference this Artifactory vulnerability, documenting its role in a real-world supply-chain event rather than in laboratory research. No packaged exploit tool appears among the references, and the High attack complexity means opportunistic mass exploitation is unlikely — which is consistent with the modest EPSS score of about 0.6% (46th percentile). The realistic threat model is a determined attacker with a valid account targeting a specific organisation's build pipeline, so defenders should weigh this vulnerability by the value of what their Artifactory distributes rather than by its CVSS score.
Remediation
- Follow the CISA KEV required action. Apply mitigations in accordance with JFrog's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 10 September 2026 has passed.
- Upgrade Artifactory to 7.146.35 or, on the 7.161 line, to 7.161.16 or later. All builds below those versions are affected; consult the JFrog self-managed release notes and security advisories for the exact upgrade path for your branch.
- Review and restrict remote Docker repositories. The flaw is conditioned on remote-repository behaviour, so audit which remote Docker repositories are configured, remove those that are not needed, restrict which upstream registries Artifactory is permitted to proxy, and limit which authenticated users may trigger caching from remote repositories.
- Hunt for files written outside the Docker cache and validate image integrity. Inspect the Artifactory filesystem for files whose location or timestamps do not match the expected cache layout, compare stored image layers and manifests against their upstream digests, and review audit logs for remote-repository pulls by unexpected users. OpenAI's technical report on the Hugging Face incident and its accompanying write-up describe how this class of defect featured in a real incident and are worth reading for indicators.
- Harden path handling and supply-chain trust long term by enforcing least-privilege permission targets so that ordinary users cannot reach remote-repository caching they do not need, enabling image signing and digest pinning so that downstream pipelines reject content that does not match what was expected, and — as the general defence for this weakness class — validating path components against an allowlist and canonicalising every constructed path before verifying it still resides inside the permitted base directory.
Technical Details
CVE-2026-66384 is a path traversal flaw (CWE-22) in JFrog Artifactory's handling of the Docker cache. When Artifactory caches content obtained through a remote repository, it constructs filesystem paths from data associated with that remote content; under specific remote-repository conditions those path components are not sufficiently confined to the intended cache directory, so the resolved write target can lie outside it. The attacker must hold a valid Artifactory account, which is why privileges are rated Low rather than None, and must arrange the particular remote-repository state the flaw depends on, which is what drives the High attack complexity rating — this is not a single-request exploit. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N captures the resulting shape precisely: network-reachable, hard to exploit, requiring low privileges and no user interaction, with high integrity impact and no confidentiality or availability effect, at unchanged scope. In an artifact repository, a constrained out-of-bounds write is nonetheless significant, because the written content may be served to consumers that trust the repository as an authoritative source.
Frequently Asked Questions
Is CVE-2026-66384 being actively exploited?
Yes. CISA added CVE-2026-66384 to its Known Exploited Vulnerabilities catalog with a remediation due date of 10 September 2026, and OpenAI's public technical report on the Hugging Face incident references this Artifactory vulnerability, documenting its use in a real supply-chain event. Because attack complexity is high and an account is required, the risk is targeted rather than opportunistic.
What products are affected by CVE-2026-66384?
JFrog Artifactory is affected in all versions before 7.146.35 and, on the 7.161 release line, before 7.161.16. The vulnerable behaviour occurs in Docker cache handling under specific remote-repository conditions.
How do I fix CVE-2026-66384?
Upgrade Artifactory to 7.146.35 or 7.161.16 or later as listed in JFrog's release notes and security advisories. Also review which remote Docker repositories are configured and who may trigger caching from them, inspect the filesystem for files written outside the expected cache layout, and verify stored image layers against their upstream digests.
How severe is CVE-2026-66384?
CVE-2026-66384 is rated Medium with a CVSS 3.1 base score of 5.3, reflecting high attack complexity, a required authenticated account and an impact limited to integrity — no data disclosure and no service disruption. That score understates the practical risk in supply-chain terms, since writing outside the Docker cache in a repository that downstream builds trust can propagate far beyond the affected server, and confirmed KEV-listed exploitation means patching should not be deferred.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.