CVE-2026-70551: CWE-918 Server-Side request forgery (SSRF) in jfrog artifactory

This vulnerability (CVE-2026-70551) in JFrog Artifactory involves CWE-918 (Server-Side Request Forgery). A user who can read an existing remote Version Control System (VCS) repository can manipulate the repository's configured origin or provide an absolute VCS data URL. This manipulation can cause the server to make unintended requests, potentially exposing internal network resources or sensitive data. The CVSS v3.1 score is 8.5, indicating high severity, with network attack vector, low attack complexity, low privileges required, no user interaction, and impact including high confidentiality loss, limited integrity loss, and no availability impact. The affected versions explicitly include 7.146.0 and 7.161.0. No vendor advisory or patch information is currently available.

An attacker with read access to a remote VCS repository in affected versions of JFrog Artifactory can exploit this SSRF vulnerability to cause the server to make unauthorized requests. This can lead to high confidentiality impact by potentially exposing sensitive internal resources or data. Integrity impact is limited, and availability is not affected. The vulnerability could be leveraged to bypass network restrictions or access internal services not normally reachable by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict read access to remote VCS repositories to trusted users only and monitor for unusual repository configuration changes. Avoid exposing Artifactory instances to untrusted networks. Follow vendor updates closely for any forthcoming patches or mitigations.