JFrog Artifactory CVE-2026-70548

Exploitation requires an authenticated Artifactory account with at minimum low-level (non-administrative) user privileges (CVSS PR:L). High attack complexity (CVSS AC:H) means specific, undisclosed circumstances must be present - likely a particular External Dependency configuration state, CocoaPods integration being enabled and accessible to the user's role, or a specific package request format. Unauthenticated exploitation is not supported by the CVSS vector (PR:L, not PR:N). The CocoaPods external repository integration within Artifactory must be active and reachable by the low-privilege user. No interaction from a privileged user is required (UI:N). Impact is constrained to limited availability degradation (A:L) with no confidentiality or integrity compromise per the CVSS vector, limiting the attacker's direct gain to service disruption or internal network probing via SSRF.

The CVSS 3.5 (Low) score with vector AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L places this at the lower end of severity: exploitation requires authenticated low-privilege access and high-complexity conditions, with impact limited to availability and no direct data exfiltration. The scope change (S:C) is the most operationally significant signal - it indicates the SSRF can reach resources beyond Artifactory itself, which in environments where the server has broad internal network access could enable internal host enumeration or service probing, a risk not fully captured by the base score. No EPSS score was provided in the source data, leaving exploitation probability unquantified; no KEV listing exists and no public exploit has been identified, making this a low-priority finding for most teams. The high attack complexity (AC:H) substantially limits opportunistic exploitation, and organizations should prioritize this patch based on their Artifactory server's network position rather than the raw CVSS score alone.

An authenticated Artifactory user with low-level permissions crafts a package dependency resolution request that, under specific undisclosed conditions, causes the Artifactory server to make an outbound HTTP request to a remote CocoaPods repository URL - potentially an attacker-influenced endpoint or an internal network service reachable from the server. Response timing or behavior differences could reveal internal network topology. No public exploit code has been identified, and the AC:H requirement means the triggering conditions are non-trivial to reliably reproduce.