CVE-2026-65924

Summary

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive the response content.

Affected Software

VendorProductVersion RangeStatus
jfrogartifactory0 < 7.111.18affected
jfrogartifactory7.117.0 < 7.117.25affected
jfrogartifactory7.125.0 < 7.125.18affected
jfrogartifactory7.133.0 < 7.133.27affected
jfrogartifactory7.146.0 < 7.146.34affected
jfrogartifactory7.161.0 < 7.161.15affected

Weaknesses

  • CWE-918: CWE-918 Server-Side Request Forgery (SSRF)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References