CVE-2026-70548: 
Artifactory vulnerability analysis and mitigation

CVE-2026-70548 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory's External Dependency feature for CocoaPods repositories. Under specific circumstances, a low-privileged authenticated user can trigger requests to remote CocoaPods repositories via the External Dependency mechanism. The vulnerability affects Artifactory self-managed versions 7.161.0–7.161.1, 7.161.11–7.161.16, and 7.146.0–7.146.29. It was published on August 25, 2026, and carries a CVSS v3.1 base score of 3.5 (Low) (JFrog Advisory, Github Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the Artifactory server does not sufficiently validate or restrict outbound requests initiated through the CocoaPods External Dependency feature. A low-privileged user can craft requests that cause the Artifactory server to issue network-level requests to arbitrary remote CocoaPods repositories. Exploitation requires high attack complexity and low privileges, with no user interaction needed, but the scope change (S:C) indicates the impact extends beyond the vulnerable component itself (JFrog Advisory, Github Advisory).

Successful exploitation results in a low availability impact to the Artifactory service, as the attacker can cause the server to make unintended outbound network requests to remote CocoaPods repositories. There is no confidentiality or integrity impact associated with this vulnerability. The primary risk is limited denial-of-service or resource exhaustion through forced outbound requests, and the scope change indicates the impact may extend to external systems or network resources beyond the Artifactory instance itself (JFrog Advisory, Github Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time. The EPSS score is approximately 0.181% (8th percentile), indicating a low probability of exploitation within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment notes exploitation as 'none' and the attack as non-automatable (Github Advisory, JFrog Advisory).

JFrog has released patched versions addressing this vulnerability. Self-managed users should upgrade to Artifactory 7.161.19 or 7.146.36 depending on their release branch. Cloud environments have already been automatically patched and require no action. As an interim measure, administrators should restrict access to the External Dependency feature to only trusted users with appropriate privileges, and monitor for unusual outbound requests to remote CocoaPods repositories (JFrog Advisory, Artifactory Releases).