Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-65924

Server-Side Request Forgery (SSRF) via Terraform Remote repository

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
JFROG

Description

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive the response content.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jfrog artifactory

Default version status: unaffected

  • 0 to < 7.111.18affected
  • 7.117.0 to < 7.117.25affected
  • 7.125.0 to < 7.125.18affected
  • 7.133.0 to < 7.133.27affected
  • 7.146.0 to < 7.146.34affected
  • 7.161.0 to < 7.161.15affected

References