Two Critical Vulnerabilities Identified in JFrog Artifactory: Potential for Supply Chain Compromise
Recent investigations have unveiled two significant vulnerabilities within JFrog Artifactory, a prominent artifact repository, that could empower anonymous or low-privileged users to alter package metadata, thereby compromising the integrity of software supply chains. These vulnerabilities pose serious risks as they allow manipulations without altering the underlying artifacts themselves.
The cybersecurity firm Oligo Security initially reported these flaws to JFrog on June 25. Following a thorough examination, they published detailed findings on August 20, exposing the essential characteristics and implications of these vulnerabilities. The issues have been classified under CVE-2026-69106 and CVE-2026-65922, with severity ratings of 8.8 and 5.4 on the Common Vulnerability Scoring System (CVSS), respectively.
Vulnerabilities Overview
CVE-2026-69106 centers around the mishandling of the X-Orig-Client-Uri header. JFrog Artifactory accepts this header from external clients without adequate verification to ensure that it originates from trusted routing infrastructure. Oligo’s research indicates that this oversight could lead to cross-user cache poisoning within virtual repositories. In practical terms, an attacker could manipulate the metadata generated by Artifactory, allowing a crafted URL to be linked to a generated metadata set, even though the actual cache location is determined by a 32-bit Java hash.
This serious vulnerability highlights the importance of stringent security measures when dealing with user-generated content. While the npm package management system featured a separate cache guard, it only monitored two other override headers, excluding the crucial X-Orig-Client-Uri header from its checks.
Moreover, additional issues were discovered regarding JFrog’s recommended Nginx configuration. The X-Forwarded-Proto header could potentially be manipulated to influence the generation of absolute URLs, especially when a caching reverse proxy is in place, further exacerbating the situation.
Concerns about Trusted Metadata Paths
The second vulnerability, CVE-2026-65922, focuses on the internal handling of .jfrog/ metadata paths by Artifactory. The REST COPY and MOVE APIs, along with the WebDAV MKCOL, can access these paths without the standard protections typically applied to uploads. As a result, this creates a significant security loophole. The authorization mechanisms mistakenly consider the .jfrog/ directory as a trusted location, allowing authenticated users with appropriate repository access to place or create content there.
Oligo Security raised concerns that these vulnerabilities could be particularly detrimental since the metadata files stored in the .jfrog/ directory play essential roles in various package handling operations. They include functionalities related to npm signing keys, OCI referrers, Docker indexes, and Ansible indexes. Any unauthorized manipulation of these files could lead to far-reaching consequences, potentially affecting multiple project dependencies and disrupting software supply chains.
Recommended Mitigations
In light of these findings, Oligo Security has urged users of JFrog Artifactory to upgrade to patched versions that rectify these vulnerabilities. Additionally, they have recommended disabling anonymous access in environments where it is unnecessary, especially in shared settings or those accessible via the internet.
Further best practices include conducting comprehensive reviews of users and service accounts that have repository access. Organizations should consider stripping or overriding client-supplied headers, such as X-Orig-Client-Uri and X-Forwarded-Proto, at the routing boundary to fortify security and mitigate risks associated with these vulnerabilities.
In summary, these critical vulnerabilities represent a clear reminder of the importance of stringent security protocols in software development and deployment. As more organizations transition to cloud-based solutions, the need for robust security frameworks will only continue to grow. Stakeholders in software supply chain management must stay aware of potential risks and adopt best practices to safeguard their systems against similar threats in the future.