CVE-2026-70548: 
Artifactory vulnerability analysis and mitigation

CVE-2026-70548 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory's External Dependency feature for CocoaPods repositories. Under specific circumstances, a low-privileged authenticated user can trigger requests to remote CocoaPods repositories via the External Dependency mechanism. The vulnerability affects JFrog Artifactory self-managed versions 7.161.0–7.161.1, 7.161.11–7.161.16, and 7.146.0–7.146.29. It was published on August 25, 2026, with a CVSS v3.1 base score of 3.5 (Low) (JFrog Advisory, Github Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the Artifactory server does not sufficiently validate or restrict outbound requests initiated through its External Dependency feature for CocoaPods package types. A low-privileged user can craft a request that causes the Artifactory server to issue network requests to arbitrary remote CocoaPods repositories, effectively using the server as a proxy. Exploitation requires low privileges, high attack complexity, and no user interaction, but the scope is changed — meaning the impact extends beyond the vulnerable component itself (JFrog Advisory, Github Advisory).

Successful exploitation results in a low availability impact to the Artifactory service, as the server can be made to issue unintended outbound network requests to remote CocoaPods repositories. There is no confidentiality or integrity impact associated with this vulnerability. The primary risk is a limited denial-of-service effect caused by resource consumption from unauthorized outbound requests, and potential abuse of the Artifactory server as a network relay (JFrog Advisory, Github Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The CVE status is listed as "Awaiting Analysis" by NVD, and the SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable. The EPSS score is approximately 0.181% (8th percentile), reflecting a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, JFrog Advisory).

JFrog has released patched versions addressing CVE-2026-70548. Self-managed users should upgrade to Artifactory version 7.161.19 or 7.146.36 depending on their release branch. JFrog Cloud environments have already been remediated and require no action. As an interim measure, administrators should restrict access to the External Dependency feature to only trusted users with appropriate privileges, and monitor for unusual outbound requests to remote CocoaPods repositories (JFrog Advisory, Artifactory Releases).