Executive brief
JFrog Artifactory is an artifact repository management system used by organizations to store and manage software packages and dependencies. When deployed using Helm (a Kubernetes package manager) under specific configurations, generated TLS private keys used for encryption can be accidentally retained in rendered deployment manifests, potentially exposing them to system administrators or other highly privileged local users with filesystem access.
Technical details
This vulnerability involves improper handling of TLS private key material during Helm chart rendering in self-hosted Artifactory deployments. The root cause is that sensitive cryptographic keys are not being properly redacted from rendered Kubernetes manifests that may be stored on disk or in logs. The vulnerability requires specific self-hosted Helm configurations and affects local attackers with high privileges (e.g., system administrators or container runtime access) who can read filesystem contents or rendered manifest files. An attacker with such access could extract the TLS private keys to decrypt communications or forge certificates. Patches are available in versions 7.146.35 and 7.161.16 and later.
Affected products
- JFrog Artifactory < 7.146.35; 7.161.0 - 7.161.16
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Fix available in versions 7.146.35 and 7.161.16+