EUVD-2026-65518
GHSA-h587-855f-ggwq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Network-reachable SSRF requiring only low-privilege read access; scope changes because internal systems beyond Artifactory are reachable; high confidentiality impact from potential credential/data exfiltration via internal service responses.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.
AnalysisAI
Server-Side Request Forgery (SSRF) in JFrog Artifactory allows a low-privileged authenticated user with read access to a remote VCS repository to replace the repository's configured origin URL or supply an arbitrary absolute VCS data URL, causing Artifactory's server process to issue outbound HTTP requests to attacker-controlled destinations - including internal network services, cloud metadata endpoints, or other infrastructure inaccessible from the public internet. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Artifactory itself to systems on its internal network segment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid Artifactory account with at minimum read-level permissions on at least one existing remote VCS repository - this is the critical gate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 base score is driven primarily by network vector (AV:N), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), a scope change (S:C), and high confidentiality impact (C:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the Artifactory self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases to identify the patched version and upgrade accordingly - exact fix version numbers are not independently confirmed from the data available at time of analysis, so do not rely on inferred version numbers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all JFrog Artifactory instances and document which users hold read access to remote VCS repositories; contact JFrog support to confirm patch availability status and request interim mitigation guidance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Artifactory
View allPath traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Cache metadata poisoning in JFrog Artifactory enables a low-privileged authenticated user to corrupt cached artifact met
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today