JFrogCVE-2026-65618

JFrog artifactory: server-side request forgery

Medium6.5CVE-2026-65618 · Published Jul 27, 2026 · updated Jul 30, 2026

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

JFrog advisory

Affected versions

Package	Affected	Fixed in
artifactory Product	< 7.133.6	7.133.6

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-918

More JFrog advisories

All JFrog

Date	Advisory	Severity	Fixed in
Jul 27	JFrog artifactory: information disclosure Medium6.5Jul 27 CVE-2026-660187.146.34+1 more	Medium6.5	7.146.34+1 more
Jul 27	JFrog artifactory: path traversal High8.8Jul 27 CVE-2026-659217.111.18+3 more	High8.8	7.111.18+3 more
Jul 27	JFrog artifactory: missing authorization High7.1Jul 27 CVE-2026-659227.111.18+3 more	High7.1	7.111.18+3 more
Jul 27	JFrog artifactory: server-side request forgery Medium6.8Jul 27 CVE-2026-659237.111.18+3 more	Medium6.8	7.111.18+3 more
Jul 27	JFrog artifactory: server-side request forgery Medium6.5Jul 27 CVE-2026-659247.111.18+3 more	Medium6.5	7.111.18+3 more
Jul 27	JFrog artifactory: server-side request forgery Medium6.5Jul 27 CVE-2026-659257.111.18+3 more	Medium6.5	7.111.18+3 more

Affected versions

More JFrog advisories

Critical advisories by email