The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog with CVE-2026-66384, a high-impact improper limitation of a pathname to a restricted directory (path traversal) vulnerability in JFrog Artifactory.
Widely deployed across Fortune 500 enterprises as the central nervous system for continuous integration and continuous delivery (CI/CD) pipelines, Artifactory serves as the authoritative binary repository for Docker images, npm packages, PyPI wheels, and Maven artifacts. Carrying a CVSS v3.1 rating of 9.4, the flaw enables threat actors to subvert build artifact verification and poison software supply chains at scale.
Technical Mechanics: Remote Repository Docker Cache Path Confusion
The vulnerability originates in how Artifactory caches and validates layer blobs for remote Docker registries:
- Path Sanitization Failure: When an authenticated user requests an image through a remote Docker repository cache, the Artifactory backend constructs local filesystem storage paths for layer blobs using user-supplied digest parameters.
- Directory Traversal Injection: Insufficient canonicalization of URL-encoded traversal sequences (such as
..%2f..%2f) allows the attacker to manipulate the resolved filesystem destination on the Artifactory server host. - Overwriting Production Artifacts: The attacker writes arbitrary binary data outside the designated repository storage root, overwriting base OS images, application libraries, or shared build scripts utilized by downstream automated build agents.
Software supply chain attacks that compromise binary repositories are uniquely insidious. When developers and CI runners pull poisoned container layers from what they trust as their private internal registry, malicious payloads are seamlessly signed and deployed straight into production clusters.
Affected JFrog Artifactory Versions & Patched Releases
| Artifactory Edition | Affected Release Versions | Patched Version | Remediation Status |
|---|---|---|---|
| JFrog Artifactory Enterprise / Pro (7.x) | 7.0.0 through 7.84.x | 7.85.3 or later | Immediate Patch Mandate |
| JFrog Artifactory Enterprise+ Cloud | SaaS Managed Instances | Auto-Remediated | Vendor Hotfix Applied |
| Artifactory Community / OSS | All versions prior to 7.85.3 | 7.85.3 | Upgrade Required |
DevSecOps Audit & Remediation Directive
DevSecOps leaders, build engineers, and platform teams must execute the following detection and mitigation protocol immediately:
# Audit Artifactory access logs for path traversal character encodings
grep -E "%2e%2e%2f|../|..\" /var/opt/jfrog/artifactory/log/artifactory-request.log
# Verify hash integrity of cached Docker manifest files
sha256sum /var/opt/jfrog/artifactory/data/filestore/*/*/*
# Verify Artifactory running build release
curl -s -u admin:password -X GET "http://localhost:8081/artifactory/api/system/version"
Defensive Hardening Playbook
- Immediate Upgrade: Upgrade self-hosted JFrog Artifactory instances to version 7.85.3 or later, which enforces strict canonical path normalization before committing cached blobs to disk.
- Enforce Binary Authorization & Cosign Verification: Implement cryptographic signature verification (e.g., Sigstore Cosign) within deployment pipelines to reject container images whose checksums have altered post-build.
- Audit Remote Docker Registries: Temporarily restrict repository caching permissions to trusted public registries and enforce least-privilege role-based access control (RBAC) across all CI service accounts.
