JFrogCVE-2026-70551

JFrog artifactory: server-side request forgery

High8.5CVE-2026-70551 · Published Aug 25, 2026 · updated Aug 28, 2026

A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.

Affected versions

Package	Affected	Fixed in
artifactory Product	>= 7.161.0, < 7.161.19	7.161.19
	>= 7.146.0, < 7.146.36	7.146.36

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-918

More JFrog advisories

Date	Advisory	Severity	Fixed in
Aug 28	JFrog artifactory: improper authentication Critical9.8Aug 28 CVE-2026-823297.111.21+3 more	Critical9.8	7.111.21+3 more
Aug 25	JFrog artifactory: server-side request forgery Low3.5Aug 25 CVE-2026-705487.161.19+1 more	Low3.5	7.161.19+1 more
Aug 25	JFrog artifactory: missing authorization Medium6.5Aug 25 CVE-2026-705507.161.19+1 more	Medium6.5	7.161.19+1 more
Aug 25	JFrog artifactory: information disclosure High7.6Aug 25 CVE-2026-691047.161.19	High7.6	7.161.19
Aug 12	JFrog artifactory: improper input validation High8.8Aug 12 CVE-2026-691067.146.28	High8.8	7.146.28
Aug 12	JFrog artifactory: improper authentication High7.5Aug 12 CVE-2026-420187.111.20+3 more	High7.5	7.111.20+3 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.