CVE-2026-65924

This flaw lets a bad actor “use your Artifactory server as a browser” to visit other websites or services and fetch the results. If your Terraform remote repository feature is turned on, the attacker may be able to get Artifactory to reach places it normally shouldn’t, which can lead to data being exposed or stolen.

This matters to you if you run JFrog Artifactory and you have Terraform remote repository support enabled. The risk is higher if anonymous access is enabled for that repository, because it may allow someone to trigger the behavior without logging in.

It’s a risk only when attackers can reach the feature (for example, by using the Terraform remote repository capability) and when Artifactory’s Terraform remote repository support is enabled.

This is RED because exploitation has been reported in real incidents, not just theoretical testing. Attackers can leverage the SSRF behavior to make Artifactory send outbound HTTP requests to systems they choose, which increases the chance of data exposure through unexpected outbound connections.

1. Confirm exposure

   • In your Artifactory admin/config settings, check whether “Terraform remote repository” support is enabled.
   • Determine whether anonymous access is enabled for the relevant remote repository path(s). If anonymous access is enabled, treat this as higher risk.
   • Record your exact Artifactory version.

2. Check whether you may already be affected (quick signals)

   • Look for outbound HTTP traffic originating from the Artifactory server that is unusual for your environment (new external domains, unexpected IPs, or repeated requests matching remote repository activity).
   • Correlate timing with Terraform remote repository use (for example, changes to remote repository configuration or unexpected fetches).

3. Upgrade to a fixed version (required remediation)

   • Upgrade Artifactory to one of the fixed versions:
     • 7.111.18
     • 7.117.25
     • 7.125.18
     • 7.133.27
     • 7.146.34
     • 7.161.15
   • Choose the fixed version that matches your upgrade path/branch compatibility, then plan the maintenance window according to your normal Artifactory upgrade process.
   • After upgrading, validate that Terraform remote repository functionality still works as expected.

4. If you cannot patch immediately (temporary containment)

   • Restrict Artifactory’s outbound network access as much as possible (for example, limit which external endpoints it can reach) so that even if SSRF is triggered, it cannot reach arbitrary destinations.
   • If you can disable Terraform remote repositories safely in your environment, do so until you complete the upgrade.

5. Ongoing monitoring after patching

   • Continue monitoring Artifactory outbound network connections for unexpected destinations.
   • Review any relevant Artifactory access/activity logs around Terraform remote repository operations to ensure there is no continued suspicious behavior.

CVE-2026-65924 is a Server-Side Request Forgery (CWE-918) affecting JFrog Artifactory’s Terraform remote repository feature. The core mechanism is that an attacker can cause Artifactory to issue outbound HTTP requests to arbitrary endpoints they choose, and potentially receive the response content. Authentication requirements depend on whether anonymous access is configured for the remote repository: with anonymous access enabled, an unauthenticated attacker may trigger the behavior; otherwise, an authenticated attacker is required.

Exploitation status: exploitation has been reported (real-world incident reporting indicates attackers used a JFrog Artifactory zero-day path involving SSRF behavior to escape an isolated environment and breach a third-party infrastructure).

Patch availability: multiple fixed Artifactory versions are listed (fixed in 7.111.18, 7.117.25, 7.125.18, 7.133.27, 7.146.34, 7.161.15). No CISA KEV listing was found in the provided findings.