CVE-2026-66379

Awaiting Analysis Awaiting Analysis - Queue

Puppet Module Metadata Exposure via Authentication

Publication date: 2026-08-12

Last updated on: 2026-08-28

Assigner: JFrog

Description

An authenticated user may view private Puppet module metadata without repository read access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-66379

EUVD

EUVD-2026-57248

Affected Vendors & Products

Vendor	Product	Version / Range
jfrog	artifactory	7.161.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user to view private Puppet module metadata even without having repository read access. The issue is in JFrog Artifactory and could expose sensitive information.

Detection Guidance

To detect this vulnerability, check for unauthorized access to Puppet module metadata in JFrog Artifactory. Review logs for requests to metadata endpoints by non-admin users. Verify repository permissions to ensure only authorized users can access private module metadata.

Impact Analysis

An attacker with authenticated access could access private module metadata, potentially leading to information disclosure or further exploitation of exposed data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) compliance if such data is exposed.

Mitigation Strategies

Update JFrog Artifactory to the latest patched version to address the metadata exposure issue. Ensure repository permissions are correctly configured to restrict unauthorized access.

Hi! I’m here to help you understand CVE-2026-66379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70