CVE-2026-70548: 
Artifactory Analyse et atténuation des vulnérabilités

CVE-2026-70548 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory's External Dependency feature for CocoaPods repositories. Under specific circumstances, a low-privileged authenticated user can trigger outbound requests to remote CocoaPods repositories without proper authorization. The vulnerability affects JFrog Artifactory self-managed versions 7.161.0–7.161.1, 7.161.11–7.161.16, and 7.146.0–7.146.29. It was published on August 25, 2026, and carries a CVSS v3.1 base score of 3.5 (Low) (JFrog Advisory, Github Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the Artifactory server does not sufficiently validate or restrict outbound requests initiated through its External Dependency feature for CocoaPods package resolution (Github Advisory). A low-privileged authenticated user can exploit this flaw over the network to cause Artifactory to issue requests to remote CocoaPods repositories that the user would not normally be authorized to interact with. Exploitation requires low privileges, no user interaction, and high attack complexity, meaning specific conditions must be met for the attack to succeed (JFrog Advisory). No public proof-of-concept code has been identified.

Successful exploitation results in a limited availability impact — a low-privileged user can cause the Artifactory server to make unauthorized outbound network requests to remote CocoaPods repositories, potentially contributing to service disruption or resource exhaustion. There is no confidentiality or integrity impact associated with this vulnerability. The scope is marked as "Changed," indicating that the impact extends beyond the vulnerable component itself to external CocoaPods infrastructure (Github Advisory, JFrog Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated low-privileged account and high attack complexity, further limiting practical exploitability (JFrog Advisory).

JFrog has released patched versions addressing this vulnerability. Self-managed users should upgrade to Artifactory 7.161.19 or 7.146.36 depending on their release branch (JFrog Advisory, Artifactory Releases). JFrog Cloud environments have already been automatically patched and require no action. As an interim measure, administrators should restrict access to the External Dependency feature to only trusted users with appropriate privileges, and monitor for unusual outbound requests to remote CocoaPods repositories.