CVE-2026-66380: Authenticated users may access private OCI referrer metadata
Published Aug 12, 2026
·Updated
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
Affected Software
3 affected components
OCI referrer metadata
JFrog Artifactory<7.146.35
JFrog Artifactory>=7.161.0<7.161.16
Event History
Aug 12, 2026
CVE Published
via MITRE·02:59 PM
Data Sourced
via MITRE·02:59 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:18 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-66380?
The severity of CVE-2026-66380 is rated as medium with a score of 4.3.
2
How do I fix CVE-2026-66380?
To fix CVE-2026-66380, ensure that repository read permissions are appropriately assigned to authenticated users.
3
What are the potential impacts of CVE-2026-66380?
The potential impact of CVE-2026-66380 is that authenticated users may gain unauthorized access to private OCI referrer metadata.
4
Who is affected by CVE-2026-66380?
CVE-2026-66380 affects authenticated users who do not have repository read permissions.
5
When was CVE-2026-66380 published?
CVE-2026-66380 was published on August 12, 2026.