CVE-2026-66381
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
Risk Assessment
This could expose data that should not be accessible, breaking repository isolation.
Recommendation
Review cache-deploy permissions and restrict access to upstream paths.
Other vulnerabilities in Artifactory
See all- CVE-2026-68754Medium
A repository publisher without delete permission may modify protected package content under specific conditions.
- CVE-2026-68753Medium
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
- CVE-2026-66382Medium
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
- CVE-2026-66380Medium
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
- CVE-2026-66379Medium
An authenticated user may view private Puppet module metadata without repository read access.
- CVE-2026-66378Medium
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
- CVE-2026-66377Medium
An unauthenticated user may access restricted repository information under specific conditions.
Original NVD description (English source)
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS