CVE-2026-66380
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
Risk Assessment
This could expose sensitive information about container images, violating access control.
Recommendation
Ensure repository read permissions are correctly configured and restrict access to metadata.
Other vulnerabilities in Artifactory
See all- CVE-2026-68754Medium
A repository publisher without delete permission may modify protected package content under specific conditions.
- CVE-2026-68753Medium
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
- CVE-2026-66382Medium
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
- CVE-2026-66381Medium
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
- CVE-2026-66379Medium
An authenticated user may view private Puppet module metadata without repository read access.
- CVE-2026-66378Medium
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
- CVE-2026-66377Medium
An unauthenticated user may access restricted repository information under specific conditions.
Original NVD description (English source)
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS