CVE-2026-65923

MEDIUM

Potential server-side request forgery in Artifactory Ansible repository handling

Title source: cna

Description

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

https://docs.jfrog.com/releases/docs/jfrog-security-advisories

Vendor Advisory vendor-advisory

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases

Scores

CVSS v3 6.8

EPSS 0.0019

EPSS Percentile 8.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (6)

jfrog/artifactory < 7.111.18 (2 CPE variants)

jfrog/artifactory 7.117.0 - 7.117.25

jfrog/artifactory 7.125.0 - 7.125.18

jfrog/artifactory 7.133.0 - 7.133.27

jfrog/artifactory 7.146.0 - 7.146.34

jfrog/artifactory 7.161.0 - 7.161.15

Published Jul 27, 2026

Tracked Since Jul 28, 2026