Quick answers
- Is CVE-2026-66016 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66016 being exploited in the wild.
- How severe is CVE-2026-66016?
- Medium severity, with a CVSS score of 6.7, published 12 August 2026.
- Which products and versions are affected?
- JFrog Artifactory < 7.146.35; 7.161.0 - 7.161.16.
- Is there a fix for CVE-2026-66016?
- A patch was published on 2026-08-12: Fix available in versions 7.146.35 and 7.161.16+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66016 attacked?
- It is attacked with local access, in a hosted service.
- Am I affected by CVE-2026-66016?
- Check whether you run JFrog Artifactory at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability involves improper handling of TLS private key material during Helm chart rendering in self-hosted Artifactory deployments. The root cause is that sensitive cryptographic keys are not being properly redacted from rendered Kubernetes manifests that may be stored on disk or in logs. The vulnerability requires specific self-hosted Helm configurations and affects local attackers with high privileges (e.g., system administrators or container runtime access) who can read filesystem contents or rendered manifest files. An attacker with such access could extract the TLS private keys to decrypt communications or forge certificates. Patches are available in versions 7.146.35 and 7.161.16 and later.
Affected products
- JFrog Artifactory < 7.146.35; 7.161.0 - 7.161.16
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Fix available in versions 7.146.35 and 7.161.16+