CVE-2026-70551: 
Artifactory vulnerability analysis and mitigation

CVE-2026-70551 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory, titled "Server-Side Request Forgery Via VCS Remote Download." An authenticated user with read access to an existing remote VCS (Version Control System) repository can replace its configured origin or supply an absolute VCS data URL, potentially redirecting repository operations to attacker-controlled sources. The vulnerability affects Artifactory versions 7.161.0 through 7.161.17 and 7.146.0 through 7.146.35. It was published on August 25, 2026, and carries a CVSS v3.1 base score of 8.5 (High) (JFrog Advisory, Github Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where Artifactory's VCS remote download functionality fails to sufficiently validate or restrict the URLs supplied by authenticated users. An attacker with read access to a remote VCS repository can manipulate the repository's configured origin URL or inject an absolute VCS data URL, causing the Artifactory server to issue outbound requests to attacker-controlled destinations. This attack requires low privileges (read access to a remote VCS repository), no user interaction, and is exploitable over the network with low complexity. The changed scope indicator reflects that the impact extends beyond the vulnerable component itself, as the server can be made to interact with external systems (JFrog Advisory, Github Advisory).

Successful exploitation allows an authenticated attacker to redirect Artifactory's server-side HTTP requests to arbitrary destinations, enabling interception, exfiltration, or modification of repository data. The primary impact is high confidentiality loss — sensitive repository content or internal network responses can be exposed to the attacker — with a low integrity impact due to the ability to influence repository origin configuration. Availability is not directly impacted. Because the scope is changed, the vulnerability could be leveraged to probe internal network services or cloud metadata endpoints accessible from the Artifactory server, increasing the risk of lateral movement within the hosting environment (JFrog Advisory, Github Advisory).

There is no public proof-of-concept exploit code known at this time, and no evidence of in-the-wild exploitation has been reported. The NVD SSVC assessment indicates exploitation is currently "none" and the attack is not automatable. The EPSS score is approximately 0.178% (7th percentile), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Github Advisory, JFrog Advisory).

1. Reconnaissance: Identify a JFrog Artifactory self-managed instance running a vulnerable version (7.161.0–7.161.17 or 7.146.0–7.146.35) with at least one remote VCS repository configured.
2. Authenticate: Log in to Artifactory with any account that has read access to the target remote VCS repository.
3. Identify target repository: Enumerate accessible remote VCS repositories via the Artifactory REST API or UI to find one whose origin URL can be modified.
4. Inject malicious URL: Replace the repository's configured origin URL with an attacker-controlled URL, or supply an absolute VCS data URL pointing to an internal resource (e.g., cloud metadata endpoint such as http://169.254.169.254/latest/meta-data/) or an external attacker-controlled server.
5. Trigger server-side request: Initiate a VCS download or repository sync operation, causing the Artifactory server to issue an outbound HTTP request to the injected URL.
6. Collect response data: Capture the server's response at the attacker-controlled endpoint, potentially obtaining internal network data, credentials, or cloud instance metadata (JFrog Advisory, Github Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from the Artifactory server to unusual external IPs or internal cloud metadata endpoints (e.g., 169.254.169.254, fd00:ec2::254); connections to non-standard VCS hosts not matching configured upstream repositories.
• Logs: Artifactory access logs showing VCS repository configuration changes (origin URL modifications) by non-administrative users; HTTP requests to remote VCS endpoints with unusual or absolute URLs in the request path.
• Configuration: Remote VCS repository origin URLs changed to external or internal addresses not matching expected upstream VCS providers; presence of absolute URL parameters in VCS repository settings.
• Application Logs: Artifactory application logs recording failed or unexpected outbound connection attempts to internal network ranges or cloud metadata services during VCS sync operations.

JFrog has released patched versions addressing CVE-2026-70551 for self-managed deployments: upgrade to 7.161.19 (for the 7.161.x branch) or 7.146.36 (for the 7.146.x branch). JFrog Cloud environments have already been automatically patched and require no action. As interim workarounds, administrators should restrict read access to remote VCS repositories to trusted users only, implement URL allowlisting for permitted VCS origins, and audit repository configuration changes for unauthorized origin modifications (JFrog Advisory, Artifactory Releases).

JFrog disclosed this vulnerability as part of a broader August 25, 2026 security advisory release that addressed multiple Artifactory vulnerabilities simultaneously, including a critical authentication bypass (CVE-2026-82329). No notable independent researcher commentary or significant social media discussion specific to CVE-2026-70551 has been identified beyond standard CVE aggregator coverage (JFrog Advisory).