Executive brief
JFrog Artifactory, a platform for managing software packages and dependencies, contains a vulnerability in how it handles Cargo remote repositories. An authenticated user with basic read access can trick the system into making requests to unintended web addresses and returning the data from those locations. This could allow an attacker to access internal resources or sensitive information that should not be reachable from the outside.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in JFrog Artifactory's Cargo remote repository implementation. The flaw allows an authenticated user with read permissions to manipulate the application into sending requests to arbitrary URLs and returning the resulting content. The attack is network-reachable and requires low privileges (PR:L) but no user interaction. This can be used to probe internal network services or exfiltrate data from internal endpoints that the Artifactory server can reach. Patches are available in versions 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, and 7.161.15.
Affected products
- JFrog Artifactory < 7.111.18, 7.117.0 - 7.117.24, 7.125.0 - 7.125.17, 7.133.0 - 7.133.26, 7.146.0 - 7.146.33, 7.161.0 - 7.161.14
Timeline
- 2026-07-27: disclosed
- 2026-07-27: advisory
- 2026-07-27: patched: Fixed in Artifactory 7.161.15 and other maintenance releases.