CVE-2026-68754: Publishers without delete permission can overwrite docker layer information
Published Aug 12, 2026
·Updated
A repository publisher without delete permission may modify protected package content under specific conditions.
Affected Software
3 affected components
Docker
JFrog Artifactory<7.146.35
JFrog Artifactory>=7.161.0<7.161.16
Event History
Aug 12, 2026
CVE Published
via MITRE·02:58 PM
Data Sourced
via MITRE·02:58 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:18 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-68754?
CVE-2026-68754 has a medium severity rating of 6.5.
2
How do I fix CVE-2026-68754?
To mitigate CVE-2026-68754, ensure that users without delete permissions cannot modify protected package content.
3
What does CVE-2026-68754 affect?
CVE-2026-68754 affects Docker repositories by allowing publishers without delete permissions to overwrite docker layer information.
4
Who is impacted by CVE-2026-68754?
CVE-2026-68754 impacts repository publishers who do not have delete permissions.
5
What are the conditions for CVE-2026-68754 to occur?
CVE-2026-68754 occurs under specific conditions where a publisher can modify protected package content without sufficient permissions.