CVE-2026-66016

Rendered Artifactory Helm manifests may contain generated TLS private keys

Medium6.7EPSS 0.12%

Published: 12 Aug 2026
Updated: 12 Aug 2026
Reserved: 23 Jul 2026
Assigned by: JFROG

Description

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.

Scores

CVSS scores of CVE-2026-66016, by who scored it
Scored by	CVSS	Score	Vector
JFROGCNA (assigner)	3.1	Medium6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	Medium6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.12% · top 98% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.7.

Weakness

CWE-312 Cleartext Storage of Sensitive Information (opens in a new tab)All about CWE-312 and its CVEs

Affected products

jfrog · artifactory
- affected < 7.146.35
- affected 7.161.0 – < 7.161.16

References (2)

https://docs.jfrog.com/releases/docs/jfrog-security-advisories (opens in a new tab)vendor-advisory
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-66016](https://trackcve.app/badge/CVE-2026-66016.svg)](https://trackcve.app/cve/CVE-2026-66016)

Record last updated 12 Aug 2026, 18:40 UTC.