CVE-2026-66379
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An authenticated user may view private Puppet module metadata without repository read access.
Risk Assessment
This could expose sensitive information about Puppet modules, violating access control.
Recommendation
Review and fix repository read permission configuration for Puppet modules.
Other vulnerabilities in Artifactory
See all- CVE-2026-68754Medium
A repository publisher without delete permission may modify protected package content under specific conditions.
- CVE-2026-68753Medium
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
- CVE-2026-66382Medium
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
- CVE-2026-66381Medium
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
- CVE-2026-66380Medium
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
- CVE-2026-66378Medium
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
- CVE-2026-66377Medium
An unauthenticated user may access restricted repository information under specific conditions.
Original NVD description (English source)
An authenticated user may view private Puppet module metadata without repository read access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS