- On June 25, Oligo Security reported two vulnerabilities in JFrog Artifactory, which were detailed in research published on August 20, enabling potential software supply chain attacks.
- The vulnerabilities include CVE-2026-69106 (CVSS score 8.8), affecting the handling of the X-Orig-Client-Uri header, and CVE-2026-65922 (CVSS score 5.4), which allows writes into trusted .jfrog/ metadata paths.
- Flux Mirror aims to solve long-standing operational problems with artefacts hosted in registries outside an organisation’s control, highlighting examples like Broadcom’s decision in 2025 to change registry policies.
- Flux Mirror uses Gitless GitOps to mirror artifacts with verification and drift detection, allowing teams to manage their software supply chain more effectively.
- CVE-2026-69106 allowed cross-user cache poisoning due to Artifactory accepting X-Orig-Client-Uri from external clients without proper verification.
- CVE-2026-65922 affected Artifactory's handling of internal .jfrog/ metadata, allowing authenticated users to manipulate content without normal protections.
- Oligo recommended upgrading Artifactory to a patched release and disabling anonymous access where not required, especially in shared environments.
Recent vulnerabilities in JFrog Artifactory, reported by Oligo Security, could allow unauthorized users to manipulate package metadata, creating significant risks for software supply chains. The flaws include CVE-2026-69106 (CVSS score 8.8) and CVE-2026-65922 (CVSS score 5.4), which could lead to cache poisoning and unauthorized content creation.1256
Oligo's research highlights that Artifactory's handling of the X-Orig-Client-Uri header is flawed, allowing external clients to send unverified requests. This could result in a cross-user cache poisoning issue, where a malicious user could serve poisoned indices to others. The researchers recommend upgrading Artifactory and disabling anonymous access in shared environments.
In response to operational challenges, Flux has launched Flux Mirror, a CLI plugin designed to enhance control over container images and artifacts in Kubernetes environments. This tool allows teams to mirror artifacts from registries they operate, addressing concerns about external registry policies.
/filters:no_upscale()/news/2026/08/flux-mirror-gitless-gitops/en/resources/1Screenshot%20From%202026-08-18%2016-03-32-1787065800503.png)
Flux Mirror supports three main artifact categories and offers features like byte-for-byte copying of container images and mirroring Helm charts into OCI registries. It ensures that artifacts are signed correctly and can carry over SBOMs and build provenance, enhancing security and compliance.
The integration of Flux Mirror into Gitless GitOps pipelines allows teams to verify artifact attestations before use, ensuring a more secure and controlled software supply chain.4
“Flux Mirror copies container images byte-for-byte, mirrors Helm charts into OCI registries, and enforces a minimum age for Cosign signatures to block newly signed artifacts. It also carries over SBOMs and build provenance, letting Flux re-check evidence on the cluster.”
infoq.com
