CVE-2026-66384: JFrog Artifactory Path Traversal in Docker Cache — Detection and Remediation Guide

On August 27, 2026, CISA added CVE-2026-66384 to the Known Exploited Vulnerabilities (KEV) catalog, confirming what many of us in the DFIR community suspected: threat actors are actively abusing an improper limitation of a pathname to a restricted directory (CWE-22, path traversal) vulnerability in JFrog Artifactory — the artifact repository sitting at the heart of countless CI/CD pipelines and software supply chains.

The vulnerability allows an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. Read that again carefully: an attacker with valid credentials — phished, leaked, or a malicious insider — can write arbitrary content outside the designated Docker cache directory. In a worst-case scenario, that means poisoned container images, overwritten artifacts, or planted payloads that flow directly into production builds. This is a supply-chain integrity problem, not just a file-write bug.

Given the KEV listing, federal civilian agencies are bound by BOD 26-04 (Prioritizing Security Updates Based on Risk) remediation timelines, and CISA's Forensics Triage Requirements apply. Every private-sector organization running Artifactory should treat this with the same urgency. If you cannot patch, CISA's guidance is unambiguous: follow BOD 26-04 cloud-service provisions or discontinue use of the product.

Technical Analysis

What We Know

How the Attack Works — Defender's View

Artifactory's Docker remote-repository feature proxies and caches upstream container registries (e.g., Docker Hub, ECR, GCR). Cached blobs and manifests are stored under a defined cache path. The flaw lives in how Artifactory validates and canonicalizes path components derived from client-supplied input — such as repository keys, image names, or tag/path segments in Docker Registry HTTP API (/v2/) requests.

Under the vulnerable conditions, an authenticated user can supply path segments containing traversal sequences (../, URL-encoded %2e%2e%2f, or double-encoded %252e) that escape the intended cache directory. The resulting write operation lands in an attacker-chosen filesystem location.

Exploitation requirements that shape your detection strategy:

1. Authentication is required — so every exploitation attempt is tied to a user account, token, or service identity. Audit your Artifactory access tokens, CI service accounts, and any stale credentials immediately.
2. A Docker remote repository must be configured — environments without Docker remote repos have reduced exposure, but do not assume safety without verifying your repository topology.
3. Write primitives are the payload — post-exploitation, expect attackers to target artifact integrity: overwriting cached layers, planting malicious content that downstream builds will trust implicitly.

The KEV listing means exploitation is not theoretical. Assume the traversal primitive is being chained with supply-chain objectives: artifact poisoning and persistence inside build infrastructure.

Detection & Response

The most reliable telemetry sources for this vulnerability are (1) Artifactory's request/access logs (access.log, request.log under $JFROG_HOME/artifactory/var/log/), which capture authenticated user, HTTP method, request path, and status code; and (2) filesystem integrity monitoring around the Artifactory data and cache directories. Forward both to your SIEM if you have not already — this is table stakes for build infrastructure.

Sigma Rules

The first rule targets traversal sequences in Artifactory Docker endpoint requests (web/access log source). The second targets the Artifactory Java process spawning unexpected child processes — a common post-exploitation behavior once a write primitive lands webshells or scripts.

---
title: JFrog Artifactory Path Traversal Attempt Against Docker Endpoints
id: 8f2a1b34-6c9d-4e7f-a123-9b0c4d5e6f78
status: experimental
description: Detects path traversal sequences in requests to JFrog Artifactory Docker registry and repository endpoints, consistent with exploitation of CVE-2026-66384.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri|contains:
      - '/artifactory/api/docker/'
      - '/v2/'
      - '/artifactory/api/v2/'
  selection_traversal:
    cs-uri|contains:
      - '../'
      - '..%2f'
      - '%2e%2e'
      - '%252e'
      - '..\\'
      - '..%5c'
  condition: selection_endpoint and selection_traversal
falsepositives:
  - Rare; legitimate Docker client requests should not contain traversal sequences in the URI
level: high
---
title: JFrog Artifactory Process Spawning Suspicious Child Process
id: 3c7d9e12-4a5b-48f0-b234-1a2b3c4d5e6f
status: experimental
description: Detects the Artifactory Java service spawning shells or script interpreters, a potential post-exploitation indicator following arbitrary file write via CVE-2026-66384.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'artifactory'
    ParentImage|endswith:
      - '/java'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Artifactory startup scripts or plugin/groovy user plugins executed by administrators — baseline and tune per environment
level: high

KQL — Microsoft Sentinel Hunt

This query assumes Artifactory access/request logs are ingested via Syslog/CEF (standard for Linux-hosted Artifactory). It hunts for traversal patterns in Docker endpoint requests, then pivots to the authenticated identity. Run it over at least 30 days — KEV addition confirms exploitation, so retro-hunting matters.

// Hunt: Path traversal attempts against Artifactory Docker endpoints (CVE-2026-66384)
let TraversalPatterns = dynamic(["../", "%2e%2e", "%252e", "..%2f", "..%5c", "..\\"]);
union isfuzzy=true
    (Syslog
    | where SyslogMessage has_any ("/artifactory/api/docker/", "/v2/_catalog", "/v2/", "/api/v2/")
    | where SyslogMessage has_any (TraversalPatterns)
    | extend RequestPath = extract(@"(GET|PUT|POST|PATCH|DELETE|HEAD)\s+(\S+)", 2, SyslogMessage)
    | extend AuthenticatedUser = extract(@"(?i)(user|username|auth)[=: ]+([\w@.\-]+)", 2, SyslogMessage)
    | project TimeGenerated, Computer, ProcessName, AuthenticatedUser, RequestPath, SyslogMessage),
    (CommonSecurityLog
    | where RequestURL has_any ("/artifactory/api/docker/", "/v2/", "/api/v2/")
    | where RequestURL has_any (TraversalPatterns)
    | project TimeGenerated, Computer=DeviceName, SourceIP, RequestUserName, RequestURL, RequestMethod, RequestProtocol)
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by Computer, RequestPath, AuthenticatedUser
| order by AttemptCount desc;
// Pivot: after confirming traversal attempts, enumerate ALL activity by the implicated identities
// to scope what the attacker may have written or modified.

Velociraptor VQL — Endpoint Hunt

Use this artifact across your Artifactory hosts to surface two things: (1) suspicious files recently written outside the Docker cache tree by the Artifactory service account, and (2) active network connections from the Artifactory Java process to unexpected destinations (staging/exfil following a successful write).

-- CVE-2026-66384 triage: Artifactory process connections + recent file writes outside Docker cache
-- Adjust CacheRoot and DataRoot to match your deployment (defaults shown for Linux installs)
LET CacheRoot <= '/var/opt/jfrog/artifactory/cache'
LET DataRoot <= '/var/opt/jfrog/artifactory'

-- 1) Network connections owned by the Artifactory JVM
SELECT Pid, Name, Path AS ExePath, Laddr, Lport, Raddr, Rport, Status
FROM netstat()
WHERE Name =~ 'java' AND Path =~ 'artifactory|jfrog'
  AND Rport NOT IN (8081, 8082, 8046, 8045, 8040, 5432, 443)

-- 2) Recently modified regular files under the Artifactory data root
--    that sit OUTSIDE the expected Docker cache path (potential traversal writes)
LET SuspiciousWrites = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=DataRoot + '/**', accessor='file')
WHERE NOT FullPath =~ CacheRoot
  AND Mtime > now() - 86400 * 7  -- last 7 days; widen for retro-hunt
  AND NOT IsDir

SELECT FullPath, Size, Mtime FROM SuspiciousWrites ORDER BY Mtime DESC

Remediation

Treat this as an emergency change. The KEV listing means exploitation is happening now, and BOD 26-04 timelines apply to federal agencies.

1. Patch immediately. Apply the fixed Artifactory version per JFrog's official advisory and release notes (https://jfrog.com/help/ — check the Artifactory security advisories and upgrade documentation). Confirm your exact build against the fixed-version list in the vendor advisory before and after upgrade.
2. Rotate credentials. Because exploitation requires authentication, assume any account that touched a Docker remote repository may be compromised. Rotate user passwords, access tokens, API keys, and CI/CD service-account credentials. Audit token scope and expiry.
3. Verify artifact integrity. Diff cached Docker layers/manifests against the upstream registries they proxy. Any layer whose digest does not match upstream must be treated as suspect. Purge and re-pull the affected repository caches after patching.
4. Hunt retroactively. Run the detections above across at least the last 30 days of access logs. Preserve logs and filesystem images per CISA's Forensics Triage Requirements before purging caches.
5. If you cannot patch: restrict or disable Docker remote repositories, enforce strict network segmentation so Artifactory is unreachable from untrusted networks, require MFA and least-privilege on all accounts, and evaluate CISA's direction to discontinue use of the product until mitigations are available.

Verification and Hardening Script

Run this on Linux Artifactory hosts to check the deployed version, scan access logs for traversal attempts, and inventory recent writes outside the cache path. It is read-only and safe for production triage.

#!/usr/bin/env bash
# CVE-2026-66384 triage — JFrog Artifactory path traversal
set -euo pipefail

JFROG_HOME="${JFROG_HOME:-/var/opt/jfrog/artifactory}"
LOG_DIR="$JFROG_HOME/var/log"
CACHE_DIR="$JFROG_HOME/cache"
REPORT="/tmp/artifactory-cve-2026-66384-triage-$(date +%Y%m%d-%H%M%S).txt"

{
  echo "=== Artifactory version check ==="
  cat "$JFROG_HOME/app/artifactory/tomcat/webapps/artifactory/WEB-INF/lib/version.properties" 2>/dev/null \
    || curl -sk -u admin:**** "http://localhost:8081/artifactory/api/system/version" || echo "Query manually via UI: Admin > System > Version"
  echo
  echo "=== Traversal attempts in access/request logs (last 30 days of rotated logs) ==="
  zgrep -Eh "(../|%2e%2e|%252e|..%2f|..%5c)" "$LOG_DIR"/access*.log* "$LOG_DIR"/request*.log* 2>/dev/null \
    | grep -Ei "(/api/docker/|/v2/|/api/v2/)" | head -200 \
    || echo "No traversal patterns found in available logs."
  echo
  echo "=== Files modified outside cache path in last 7 days ==="
  find "$JFROG_HOME" -path "$CACHE_DIR" -prune -o -type f -mtime -7 -print 2>/dev/null | head -500
  echo
  echo "=== Docker remote repositories configured (verify exposure) ==="
  curl -sk -u admin:**** "http://localhost:8081/artifactory/api/repositories?type=remote" 2>/dev/null \
    | grep -i docker || echo "Query via UI: Admin > Repositories > Remote (packageType=docker)"
  echo
  echo "=== Artifactory JVM unexpected child processes (snapshot) ==="
  ART_PID=$(pgrep -f 'artifactory.*java' | head -1 || true)
  [ -n "${ART_PID:-}" ] && ps --ppid "$ART_PID" -o pid,comm,args || echo "No matching JVM found."
} | tee "$REPORT"

echo "Report written to $REPORT — preserve with logs per CISA Forensics Triage Requirements."

Bottom Line

CVE-2026-66384 is a path traversal with authenticated access as its only gate, sitting on infrastructure that defines what your organization ships. The write primitive outside the Docker cache path is precisely the kind of foothold that becomes artifact poisoning and CI/CD persistence. Patch per JFrog's advisory, rotate every credential that can touch Artifactory, verify cache integrity against upstream registries, and retro-hunt your access logs before you consider this closed. If remediation isn't possible, CISA's guidance leaves no middle ground: isolate it or shut it down.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub