CVE-2026-65618 - Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability

Back Back to CVE browser

MEDIUM

Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability

Published Jul 27, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.35%

Description

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

Affected products

Vendor Jfrog Product Artifactory Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <7.133.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jfrog

Artifactory

unaffected

Version	Status	Constraints
0	affected	<7.133.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (3)

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
vendor-advisoryRelease Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisories
vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49574
Advisory

Link	Providers	Tags
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases		vendor-advisoryRelease Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisories		vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49574		Advisory