JFrog Artifactory's Terraform remote repository feature is susceptible to SSRF (CWE-918), allowing an authenticated user or unauthenticated user (if anonymous access is enabled) to trigger outbound HTTP requests to arbitrary destinations and obtain the response content. This could lead to unauthorized information disclosure from internal or external systems accessible by the Artifactory server. The vulnerability affects multiple specified versions of Artifactory and has been assigned CVE-2026-65924 with a CVSS v3.1 score of 6.5 (medium severity). No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an attacker with authenticated access, or unauthenticated access if anonymous repository access is enabled, to make the Artifactory server issue HTTP requests to arbitrary destinations and receive their responses. This can lead to unauthorized information disclosure from internal networks or external systems reachable by the server. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling anonymous access on Terraform remote repositories if enabled, and restrict access to trusted users only. Monitor vendor communications for updates and apply patches promptly once available.