This vulnerability (CVE-2026-65925) in JFrog Artifactory allows an authenticated user with read access to a Cargo remote repository to exploit server-side request forgery (CWE-918). The attacker can make the Artifactory server send requests to arbitrary URLs and receive the responses, potentially exposing internal resources or sensitive information. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No vendor advisory or patch is currently available, and the affected versions are explicitly listed.

An attacker with read access to a Cargo remote repository can induce the Artifactory server to send requests to unintended URLs and obtain the responses. This can lead to unauthorized disclosure of internal or sensitive information accessible to the server. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict read access to Cargo remote repositories to trusted users only to reduce exposure. Monitor vendor communications for updates on patches or mitigations.