Executive brief
JFrog Artifactory, a popular platform for managing software packages and dependencies, contains a vulnerability in its support for Terraform remote repositories. An attacker could exploit this to force the server to make unauthorized network requests to internal or external systems. This could lead to the exposure of sensitive internal data or allow the attacker to interact with other services within the corporate network that are not normally accessible from the outside.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in JFrog Artifactory's handling of Terraform remote repositories. The flaw allows an authenticated user—or an unauthenticated user if anonymous access is enabled—to trigger outbound HTTP requests from the Artifactory server to arbitrary destinations. Because the server returns the response content to the attacker, this can be used to scan internal networks, access metadata services, or pivot to other internal resources. JFrog has addressed this by hardening controls on external Terraform URLs and requiring administrators to explicitly enable external dependency rewrites for credible URLs. Fixes are available in versions 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, and 7.161.15.
Affected products
- JFrog Artifactory < 7.111.18, 7.117.0 - 7.117.25, 7.125.0 - 7.125.18, 7.133.0 - 7.133.27, 7.146.0 - 7.146.34, 7.161.0 - 7.161.15
Timeline
- 2026-07-27: disclosed
- 2026-07-27: advisory
- 2026-07-27: patched