A metadata poisoning vulnerability in JFrog Artifactory allows authenticated attackers to manipulate cached artifacts, threatening the integrity of the software supply chain.

This issue involves improper input validation (CWE-20) that allows a low-privileged user to poison cached artifact metadata. This manipulation can trick downstream consumers into retrieving malicious or unauthorized content.

The ability to poison cached metadata is a severe risk to software supply chain integrity. If successful, an attacker could force the distribution of compromised code to development or production environments. With a CVSS score of 8.8, this vulnerability represents a critical threat to organizations that rely on Artifactory as a central component of their CI/CD pipeline.

Immediate Action: Upgrade JFrog Artifactory to version 7.146.28 or later to patch the input validation mechanism.

Proactive Monitoring: Monitor artifact retrieval logs for unexpected metadata modifications and verify the integrity of critical cached artifacts.

Compensating Controls: Restrict permissions for low-privileged users to modify repository settings or cache configurations and implement artifact signing to ensure content authenticity.

Public Exploit Available: Unknown.

Organizations using Artifactory must treat this as a high-priority update. Securing the artifact cache is essential to maintaining the integrity of the entire software build and deployment lifecycle.