Multiples vulnérabilités dans JFrog Artifactory (01 septembre 2026)
Multiple vulnerabilities have been discovered in JFrog Artifactory, allowing an attacker to compromise data confidentiality, perform SSRF attacks, and bypass security policies. These vulnerabilities affect specific versions of the software and require immediate patching to mitigate the risks.
Multiple security vulnerabilities have been identified within JFrog Artifactory. These flaws enable an attacker to potentially compromise data confidentiality, execute Server-Side Request Forgery (SSRF) attacks, and circumvent existing security policies. The affected versions of Artifactory include: 7.111.4 to 7.111.x, 7.117.x to 7.117.28, 7.125.x to 7.125.20, 7.133.x to 7.133.29, 7.146.x to 7.146.38, 7.161.x to 7.161.20, and 7.161.x. The CERT-FR has published security advisories detailing these vulnerabilities and their associated CVE IDs: CVE-2026-69104, CVE-2026-70548, CVE-2026-70550, CVE-2026-70551, and CVE-2026-82329. Users are advised to consult the JFrog security advisories for specific remediation steps and patches. These advisories can be found at: https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-69104---potential-unauthorized-repository-migration-in-jfrog-artifactory, https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-70548---ssrf-in-cocoapods-via-jfrog-artifactory-external-dependency, https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-70550---potential-unauthorized-access-to-private-composer-repository-metadata-in-jfrog-artifactory, https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-70551, and https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-82329. The vulnerabilities highlight the importance of regularly updating Artifactory to the latest stable version to minimize risk.