CVE-2026-70548 - SSRF In CocoaPods Via JFrog Artifactory External Dependency

LOW

SSRF In CocoaPods Via JFrog Artifactory External Dependency

Published Aug 25, 2026

3.5

LOW

CVSS 3.1

EPSS 0.29%

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.

Vendor Jfrog Product Artifactory Default
unaffected
Affected
- ≥ 7.146.0, < 7.146.36
- ≥ 7.161.11, < 7.161.19

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jfrog	Artifactory	unaffected	Affected ≥ 7.146.0, < 7.146.36 ≥ 7.161.11, < 7.161.19

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

Link	Providers	Tags
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases		vendor-advisory
https://docs.jfrog.com/releases/docs/jfrog-security-advisories		vendor-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-65543		Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner JFROG

Published Aug 25, 2026

Updated Aug 26, 2026

Reserved Aug 4, 2026

CISA Vulnrichment

Updated Aug 26, 2026

NVD

Status Awaiting Analysis

Modified Aug 28, 2026

Red Hat

No data

ENISA EUVD

Assigner JFROG

Published Aug 25, 2026

Updated Aug 26, 2026

GitHub

No data