JFrog Artifactory Docker cache path-traversal flaw CVE-2026-66384 used in attacks; fixed in 7.146.35 and 7.161.16
JFrog Artifactory flaw CVE-2026-66384 lets a signed-in user write files outside the Docker cache folder. CISA lists it as used in attacks. Self-hosted servers should upgrade to 7.146.35 or 7.161.16; JFrog says its cloud service needs no action.
If your organisation runs its own Artifactory server, upgrade to 7.146.35 or 7.161.16 (or later) and review which accounts have access. JFrog-hosted cloud customers need to do nothing.
What’s happening
CVE-2026-66384 is a path traversal flaw in JFrog Artifactory, the software many companies use to store and distribute software packages and container images. JFrog rates it medium (CVSS 5.3). A user who is already signed in can, under certain conditions involving remote repositories, write data outside the folder meant to hold the Docker cache. JFrog published its advisory on 12 August 2026. Versions before 7.146.35, and 7.161.0 through 7.161.16, are affected, and JFrog's fixed releases are 7.146.35 and 7.161.16. JFrog lists no workaround, and says its cloud-hosted service is already protected and needs no action. CISA added the flaw to its list of vulnerabilities being used in attacks on 27 August 2026. JFrog's own advisory does not say whether it has been exploited, and what the attacks involve has not been published in the sources read. It is a business system issue rather than a home one. Because exploitation needs a valid login, stolen or weak Artifactory accounts raise the risk. This is a different flaw from the Artifactory login bypass CVE-2026-82329.
- What
- Flaw
- Affects
- JFrog Artifactory (self-hosted)
- Affected
- JFrog Artifactory before 7.146.35
JFrog Artifactory 7.161.0 through 7.161.16 - Fixed in
- 7.146.35
7.161.16 - Since
- 12 Aug 2026
- Closed
- 27 Aug 2026
Timeline
- CISA added
CISA added CVE-2026-66384 to its list of flaws being used in attacks. Secondary sources report a federal remediation deadline of 10 September 2026. JFrog's advisory page does not say the flaw has been exploited.
- Made publicFixed
JFrog published its advisory for CVE-2026-66384, a medium-severity flaw letting a signed-in Artifactory user write data outside the intended Docker cache path. It listed fixes in 7.146.35 and 7.161.16 and no workaround.
Sources
- JFrog Security AdvisoriesJFrog · 12 Aug 2026
- CVE-2026-66384 – CVE RadarSOCRadar · 27 Aug 2026
- JFrog Product Security Update Advisory (CVE-2026-66384)AhnLab ASEC · 12 Aug 2026