Executive brief
JFrog Artifactory is a software repository manager used by organizations to manage and distribute binary artifacts and packages. A user with read access to a remote Version Control System (VCS) repository can manipulate its configuration to redirect to an attacker-controlled server or access internal systems. This could allow an attacker to exfiltrate sensitive data, access internal services, or compromise the integrity of cached artifacts.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in Artifactory's VCS remote download functionality. A user with read permissions on an existing remote VCS repository can replace its configured origin URL with an arbitrary endpoint or supply an absolute VCS data URL pointing to internal or attacker-controlled systems. The vulnerability requires authentication (repository read access). An attacker can abuse this to trigger Artifactory to make unintended requests to internal services, external attacker infrastructure, or cloud metadata endpoints, potentially leading to information disclosure or system compromise. Patches are available in fixed versions: 7.161.17+, 7.146.36+.
Affected products
- JFrog Artifactory 7.161.0 through 7.161.16; 7.146.0 through 7.146.35
Timeline
- 2026-08-25: disclosed
- 2026-08-25: advisory