JFrogCVE-2026-70548

JFrog artifactory: server-side request forgery

Low3.5CVE-2026-70548 · Published Aug 25, 2026 · updated Aug 28, 2026

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.

Affected versions

Package	Affected	Fixed in
artifactory Product	>= 7.161.11, < 7.161.19	7.161.19
	>= 7.146.0, < 7.146.36	7.146.36

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-918

More JFrog advisories

Date	Advisory	Severity	Fixed in
Aug 28	JFrog artifactory: improper authentication Critical9.8Aug 28 CVE-2026-823297.111.21+3 more	Critical9.8	7.111.21+3 more
Aug 25	JFrog artifactory: missing authorization Medium6.5Aug 25 CVE-2026-705507.161.19+1 more	Medium6.5	7.161.19+1 more
Aug 25	JFrog artifactory: server-side request forgery High8.5Aug 25 CVE-2026-705517.161.19+1 more	High8.5	7.161.19+1 more
Aug 25	JFrog artifactory: information disclosure High7.6Aug 25 CVE-2026-691047.161.19	High7.6	7.161.19
Aug 12	JFrog artifactory: improper input validation High8.8Aug 12 CVE-2026-691067.146.28	High8.8	7.146.28
Aug 12	JFrog artifactory: improper authentication High7.5Aug 12 CVE-2026-420187.111.20+3 more	High7.5	7.111.20+3 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.