An authenticated user may view private Puppet module metadata without repository read access.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.161.x prior to 7.161.16. It is, therefore, affected by the following vulnerabilities.

  - An authentication weakness that, under default configuration, may allow an unauthenticated attacker with     network access to obtain administrative privileges. (CVE-2026-65926)

  - Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered     manifests accessible to highly privileged local users. (CVE-2026-66016)

  - A low-privilege authenticated user may permanently remove protected internal metadata across repositories     under specific conditions. (CVE-2026-66375)

  - Credentials for a deleted user may remain valid for a short period under specific conditions.
    (CVE-2026-66376)

  - An unauthenticated user may access restricted repository information under specific conditions.
    (CVE-2026-66377)

  - An authenticated user without repository read permission may access private NuGet metadata under specific     conditions. (CVE-2026-66378)

  - An authenticated user may view private Puppet module metadata without repository read access.
    (CVE-2026-66379)

  - An authenticated user without repository read permission may access private OCI referrer metadata under     specific conditions. (CVE-2026-66380)

  - A repository reader with cache-deploy permission may access content outside a configured upstream path     under specific conditions. (CVE-2026-66381)

  - An authenticated user may write files outside the intended Artifactory work directory under specific     conditions. (CVE-2026-66382)

  - An authenticated user may write data outside the intended Docker cache path under specific     remote-repository conditions. (CVE-2026-66384)

  - An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is     configured in a specific way. (CVE-2026-68753)

  - A repository publisher without delete permission may modify protected package content under specific     conditions. (CVE-2026-68754)

  - A bundle writer may create misleading release promotion information under specific conditions.
    (CVE-2026-68755)

  - A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
    (CVE-2026-68756)

  - A user with access to a valid SAML response may impersonate another user under specific conditions.
    (CVE-2026-68757)

  - A low-privileged authenticated user may access restricted support information under specific conditions.
    (CVE-2026-68758)

  - A holder of a valid integration credential may impersonate other users under specific conditions.
    (CVE-2026-68759)

  - An unauthenticated user may bypass authentication under specific cache conditions. (CVE-2026-68760)

  - An unauthenticated attacker may cause untrusted package content to be cached under specific conditions,     potentially affecting artifact integrity and availability. (CVE-2026-69105)

  - An authenticated user without repository read permission may access package metadata under specific     conditions. (CVE-2026-70547)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.146.35. It is, therefore, affected by the following vulnerabilities.

  - An authentication weakness that, under default configuration, may allow an unauthenticated attacker with     network access to obtain administrative privileges. (CVE-2026-65926)

  - Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered     manifests accessible to highly privileged local users. (CVE-2026-66016)

  - A low-privilege authenticated user may permanently remove protected internal metadata across repositories     under specific conditions. (CVE-2026-66375)

  - Credentials for a deleted user may remain valid for a short period under specific conditions.
    (CVE-2026-66376)

  - An unauthenticated user may access restricted repository information under specific conditions.
    (CVE-2026-66377)

  - An authenticated user without repository read permission may access private NuGet metadata under specific     conditions. (CVE-2026-66378)

  - An authenticated user may view private Puppet module metadata without repository read access.
    (CVE-2026-66379)

  - An authenticated user without repository read permission may access private OCI referrer metadata under     specific conditions. (CVE-2026-66380)

  - A repository reader with cache-deploy permission may access content outside a configured upstream path     under specific conditions. (CVE-2026-66381)

  - An authenticated user may write files outside the intended Artifactory work directory under specific     conditions. (CVE-2026-66382)

  - An authenticated user may write data outside the intended Docker cache path under specific     remote-repository conditions. (CVE-2026-66384)

  - A Project Resource Manager may gain broader administrative privileges under specific conditions.
    (CVE-2026-68752)

  - An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is     configured in a specific way. (CVE-2026-68753)

  - A repository publisher without delete permission may modify protected package content under specific     conditions. (CVE-2026-68754)

  - A bundle writer may create misleading release promotion information under specific conditions.
    (CVE-2026-68755)

  - A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
    (CVE-2026-68756)

  - A user with access to a valid SAML response may impersonate another user under specific conditions.
    (CVE-2026-68757)

  - A low-privileged authenticated user may access restricted support information under specific conditions.
    (CVE-2026-68758)

  - A holder of a valid integration credential may impersonate other users under specific conditions.
    (CVE-2026-68759)

  - An unauthenticated user may bypass authentication under specific cache conditions. (CVE-2026-68760)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An authenticated user may view private Puppet module metadata without repository read access.
    (CVE-2026-66379)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
347965	JFrog Artifactory 7.161.x < 7.161.16 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
347964	JFrog Artifactory < 7.146.35 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
335298	Linux Distros Unpatched Vulnerability : CVE-2026-66379	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-66379

medium

Tenable Plugins

medium

medium

medium