CVE-2026-70551: 
Artifactory Analyse et atténuation des vulnérabilités

CVE-2026-70551 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory, titled "Server-Side Request Forgery Via VCS Remote Download." An authenticated user with read access to an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL, redirecting repository operations to attacker-controlled sources. Affected versions include Artifactory 7.161.0 through 7.161.18 and 7.146.0 through 7.146.35; JFrog Cloud environments have already been patched. It carries a CVSS v3.1 base score of 8.5 (High), assigned by JFrog as the CNA (JFrog Advisory, Github Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), arising from insufficient validation of user-supplied VCS origin URLs or absolute VCS data URLs in Artifactory's remote repository handling (JFrog Advisory). An authenticated user with read access to a remote VCS repository can manipulate the repository's configured origin or inject an arbitrary absolute URL, causing the Artifactory server to issue outbound HTTP requests to attacker-controlled destinations. The attack requires low privileges (read access to a VCS repository), no user interaction, and is exploitable over the network with low complexity, with a changed scope indicating impact beyond the vulnerable component itself (Github Advisory).

Successful exploitation allows an attacker to redirect Artifactory's server-side requests to arbitrary external destinations, enabling interception, modification, or exfiltration of repository data. The primary impact is high confidentiality loss — sensitive repository content or internal service responses may be exposed — with a low integrity impact from the ability to alter repository origin configuration. Availability is not directly impacted, but the changed scope means resources beyond the vulnerable Artifactory instance (e.g., internal network services reachable by the server) may be affected (JFrog Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least read access to a remote VCS repository, limiting the attack surface compared to unauthenticated vulnerabilities (JFrog Advisory).

1. Reconnaissance: Identify a JFrog Artifactory self-managed instance running a vulnerable version (7.161.0–7.161.18 or 7.146.0–7.146.35) with at least one remote VCS repository configured.
2. Authenticate: Log in to Artifactory using a low-privileged account that has read access to the target remote VCS repository.
3. Identify target repository: Enumerate accessible remote VCS repositories via the Artifactory REST API or UI to find one whose origin can be modified.
4. Inject malicious VCS URL: Modify the repository's configured origin to point to an attacker-controlled server, or supply an absolute VCS data URL referencing an internal network resource (e.g., http://internal-service/sensitive-endpoint) via the repository configuration API or UI.
5. Trigger server-side request: Initiate a VCS download or repository sync operation, causing Artifactory to issue an outbound HTTP request to the attacker-controlled or internal destination.
6. Capture response: Collect the server's response at the attacker-controlled endpoint to exfiltrate repository data, credentials, or internal service responses (JFrog Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from the Artifactory server to external or unusual internal IP addresses during VCS repository sync operations; connections to non-whitelisted domains from the Artifactory process.
• Logs: Artifactory access logs showing VCS repository configuration changes (origin URL modifications) by non-administrative users; audit log entries reflecting repository origin updates to external or internal URLs not previously configured.
• Configuration: Remote VCS repository origin URLs changed to unfamiliar or external addresses; absolute VCS data URLs present in repository configuration that differ from expected upstream sources.

JFrog has released patched versions addressing this vulnerability: upgrade Artifactory to 7.161.19 (for the 7.161.x branch) or 7.146.36 (for the 7.146.x branch). JFrog Cloud environments have already been automatically patched and require no action. As interim mitigations, restrict read access to remote VCS repositories to trusted users only, implement URL validation and whitelisting for VCS origins, and audit repository configuration changes regularly (JFrog Advisory, Artifactory Releases).