Two vulnerabilities in JFrog Artifactory have been found which allow anonymous or low-privileged users to manipulate package metadata without modifying the underlying artifacts, creating a potential route to software supply chain compromise.
Oligo Security reported the flaws to JFrog on June 25 and detailed them in research published on August 20.
The findings cover CVE-2026-69106 (CVSS score 8.8), which affects the handling of the X-Orig-Client-Uri header, and CVE-2026-65922 (CVSS score 5.4), which allows writes into trusted .jfrog/ metadata paths.
Both flaws are listed on the National Vulnerability Database and JFrog has issued fixes.
Header Trust Enables Shared Cache Poisoning
CVE-2026-69106 stemmed from Artifactory accepting X-Orig-Client-Uri from external clients without verifying that it originated from trusted routing infrastructure.
Oligo found that virtual repositories could turn this into a cross-user cache poisoning issue. In Helm, the full attacker-controlled URL was written into generated metadata while only its 32-bit Java hash was used to determine the cache location.
A different URL could therefore be constructed with the same hash and cause a poisoned index to be served to later users. npm had a separate cache guard, but it checked two other override headers and not X-Orig-Client-Uri.
The researchers also identified a related issue in JFrog’s recommended nginx configuration, where X-Forwarded-Proto could be used to influence generated absolute URLs when a caching reverse proxy was deployed.
Read more on software supply chain attacks: GitHub to Update npm to Thwart Software Supply Chain Attacks
Trusted Metadata Paths Bypass Normal Controls
CVE-2026-65922, on the other hand, affected Artifactory’s handling of internal .jfrog/ metadata. The REST COPY and MOVE APIs and WebDAV MKCOL could reach these paths without the normal protection applied to standard uploads.
The resulting authorization path treated .jfrog/ as trusted, allowing an authenticated user with suitable repository access to place or create content there.
Oligo said these files are consumed by package handlers for functions including npm signing keys, OCI referrers, Docker indexes and Ansible indexes.
The researchers recommended upgrading Artifactory to a patched release and disabling anonymous access where it is not required, particularly in shared or internet-accessible environments.
They also advised reviewing users and service accounts with repository access and stripping or overwriting client-supplied X-Orig-Client-Uri and X-Forwarded-Proto headers at the routing boundary.
