# CVE-2026-66018: JFrog Artifactory information disclosure in environment properties

Source: https://junglewise.ai/threats/cve-2026-66018-jfrog-artifactory-information-disclosure-in-environment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-66018 · Severity: medium · CVSS 6.5 · Published 2026-07-27

JFrog Artifactory, a platform used to manage and store software building blocks, has a security flaw that allows users with limited access to view sensitive information from other projects. An attacker with basic read permissions to one repository could exploit this to steal secrets and environment settings from protected builds in different repositories. This could lead to the exposure of confidential credentials or configuration data used during the software development process.

Technologies: [JFrog Artifactory Self-Managed](https://junglewise.ai/threats/technologies/artifactory-self-managed). Vendors: [JFrog](https://junglewise.ai/threats/vendors/jfrog).

## Quick answers

**Is CVE-2026-66018 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66018 being exploited in the wild.

**How severe is CVE-2026-66018?** Medium severity, with a CVSS score of 6.5, published 27 July 2026.

**Which products and versions are affected?** JFrog Artifactory Self-Managed 7.146.0 to 7.146.33, 7.161.0 to 7.161.14.

**Is there a fix for CVE-2026-66018?** A patch was published on 2026-07-27: Fixed in Artifactory 7.161.15 and 7.146.34. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66018 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-66018?** Check whether you run JFrog Artifactory Self-Managed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability (CWE-200) exists in JFrog Artifactory Self-Managed versions. The flaw allows a remote authenticated attacker with 'Build Reader' or general read access to an ordinary repository to select and retrieve repository parameters from other, potentially protected, builds. This occurs during the retrieval of environment properties, leading to the exposure of build environment secrets. The vulnerability is caused by insufficient isolation between repository environment properties. Patches are available in versions 7.146.34 and 7.161.15.

## Affected products

- JFrog Artifactory Self-Managed 7.146.0 to 7.146.33, 7.161.0 to 7.161.14

## Timeline

- 2026-07-27: advisory: JFrog published the security advisory and NVD record.
- 2026-07-27: patched: Fixed in Artifactory 7.161.15 and 7.146.34.

## References

- [https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases](https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases)
- [https://docs.jfrog.com/releases/docs/jfrog-security-advisories](https://docs.jfrog.com/releases/docs/jfrog-security-advisories)

## Related threats

- [JFrog Artifactory privilege escalation in Platform Access](https://junglewise.ai/threats/cve-2026-66015-jfrog-artifactory-privilege-escalation-in-platform-access)
- [JFrog Artifactory privilege escalation in internal request processing](https://junglewise.ai/threats/cve-2026-66014-jfrog-artifactory-privilege-escalation-in-internal-request)
- [JFrog Artifactory missing authorization in internal metadata handling](https://junglewise.ai/threats/cve-2026-65922-jfrog-artifactory-missing-authorization-in-internal-metadata)
- [JFrog Artifactory SSRF via improper URL validation](https://junglewise.ai/threats/cve-2026-65618-jfrog-artifactory-ssrf-via-improper-url-validation)
- [JFrog Artifactory deserialization weakness in package handling](https://junglewise.ai/threats/cve-2026-65617-jfrog-artifactory-deserialization-weakness-in-package-handling)