// tag

JFrog

Security incidents tagged JFrog. Newest first.

## 3 JFrog incidents in the last year

through Oct 22, 2026

crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore

show 3 older incidents

Sep 11highJFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerabilitypatched
› JFrog Artifactory patched
JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. CISA added CVE-2026-42016, CVE-2026-42018 to the Known Exploited Vulnerabilities catalog on 2026-09-11 based on evidence of active exploitation.
open incident →CVE-2026-42016 · CVE-2026-42018
Sep 2highJFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerabilitypatched
› JFrog Artifactory patched
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Added to CISA KEV on 2026-09-02.
open incident →CVE-2026-82329

Aug 27highJFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerabilitypatched
› JFrog Artifactory patched
JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. Added to CISA KEV on 2026-08-27.
open incident →CVE-2026-66384