CVE-2026-70547: 
Artifactory vulnerability analysis and mitigation

CVE-2026-70547 is a missing authorization vulnerability in JFrog Artifactory that allows an authenticated user without repository read permission to access package metadata under specific conditions. It affects JFrog Artifactory versions 7.161.0 through 7.161.15 (fixed in 7.161.16), and is classified as Medium severity with a CVSS v3.1 base score of 4.3 (Github Advisory, JFrog Advisories). The vulnerability was published on August 12, 2026, and a patch was made available the same day with the release of Artifactory 7.161.16 (JFrog Self-Managed Releases).

The root cause is classified as CWE-862 (Missing Authorization), meaning the product fails to perform an adequate authorization check when an authenticated actor attempts to access package metadata resources they should not have permission to view (Github Advisory). The attack vector is network-based, requires low privileges (a valid authenticated account), no user interaction, and low attack complexity, making it straightforward for any authenticated user to attempt. Exploitation occurs under "specific conditions" related to the Packages component, though JFrog has not publicly disclosed the precise endpoint or conditions that trigger the authorization bypass (JFrog Self-Managed Releases). No public proof-of-concept code has been identified.

Successful exploitation results in a limited confidentiality impact: an authenticated user without the appropriate repository read permission can read package metadata they are not authorized to access. There is no impact on integrity or availability, and the scope is unchanged, meaning the exposure is confined to the Artifactory instance itself (Github Advisory). In environments where package metadata contains sensitive information (e.g., internal package names, version details, or dependency structures), this could facilitate reconnaissance for further attacks or expose proprietary software supply chain information.

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Github Advisory). The EPSS score is approximately 0.204% (0.00204), placing it in the 11th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment indicates exploitation is "none" and the attack is not automatable (Feedly).

JFrog has released a fix in Artifactory Self-Managed version 7.161.16, released August 12, 2026; upgrading to this version is the recommended remediation (JFrog Self-Managed Releases). Administrators should also review repository access controls and ensure users are assigned only the permissions they require. Monitoring Artifactory access logs for unexpected package metadata access by low-privilege accounts is advised as a compensating control (JFrog Advisories).