Description

An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T15:18:21.993Z",
  "pubdate": "2026-08-12T15:18:21.993Z",
  "executiveSummary": "An access control vulnerability has been identified within Artifactory concerning the handling of credentialed remote repositories. Specifically, the flaw permits unauthenticated users to bypass established authorization mechanisms and directly access restricted content residing within the repository.\nThe vulnerability exposes sensitive artifacts and proprietary data to unauthorized external actors without requiring prior authentication or valid session credentials. This unauthorized exposure undermines the confidentiality and integrity of software supply chain assets managed within the Artifactory ecosystem.\nThe affected product is Artifactory, specifically impacting environments where remote repositories are configured with explicit credentials. The risk implications are severe, as arbitrary unauthenticated clients can traverse and retrieve protected contents that should otherwise be strictly gated behind authentication boundaries.\nTo achieve exploitation, an attacker requires network access to the vulnerable Artifactory instance and must target a specific misconfigured credentialed remote repository setup. No privileged access or prior system knowledge is necessary for successful retrieval of restricted resources, lowering the overall attack complexity for malicious actors seeking to harvest sensitive repository contents.",
  "technicalDetails": "The root cause of this vulnerability lies in improper access control enforcement within the routing and proxy mechanisms of Artifactory when processing requests for credentialed remote repositories. Under specific configuration parameters, the validation logic fails to properly verify the authentication state and authorization privileges of incoming requests before forwarding them to the underlying remote repository handler or returning cached artifacts.\nThe vulnerable component involves the request handling pipeline responsible for proxying and retrieving external artifacts from credentialed remote repository endpoints. When a request is initiated by an unauthenticated user, the internal state machine incorrectly evaluates the access permissions associated with the configured remote repository, bypassing the security checks that would normally trigger an HTTP unauthorized response.\nThe attack flow proceeds as follows: First, an unauthenticated attacker sends a standard HTTP/HTTPS request directed at a restricted resource or endpoint associated with a credentialed remote repository configured within Artifactory. Second, the vulnerable Artifactory routing module receives the request and fails to validate the absence of valid authentication credentials against the access control list governing the target repository. Third, the application processes the request, potentially leveraging the stored credentials configured for the remote repository to fetch the content or serving it directly from local proxy storage without enforcing authorization. Finally, the restricted content is returned in the HTTP response body to the unauthenticated client, successfully completing the unauthorized data retrieval.\nNetwork exposure is remote, as the vulnerability can be triggered via standard network interfaces exposed by the Artifactory service. Authentication requirements are entirely absent for the attacker, and no privilege requirements are necessary to initiate the exploit sequence. The payload behavior consists primarily of arbitrary read operations targeting restricted repository paths, resulting in the unauthorized disclosure of sensitive software packages, build artifacts, and internal dependencies."
}