CVE-2026-65618: Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability
Published Jul 27, 2026
·Updated
Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.
Affected Software
2 affected components
JFrog Artifactory
JFrog Artifactory<7.133.6
Event History
Jul 27, 2026
CVE Published
via MITRE·07:32 PM
Data Sourced
via MITRE·07:32 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-65618?
The severity of CVE-2026-65618 is medium with a score of 6.5.
2
How does CVE-2026-65618 affect my system?
CVE-2026-65618 allows an attacker to make unauthorized requests from JFrog Artifactory, potentially exposing internal services.
3
What causes CVE-2026-65618?
CVE-2026-65618 is caused by improper URL validation when handling specific URLs in JFrog Artifactory.
4
How can I fix CVE-2026-65618?
To fix CVE-2026-65618, ensure you are using the latest version of JFrog Artifactory that addresses this vulnerability.
5
What types of requests can be made due to CVE-2026-65618?
Due to CVE-2026-65618, unauthorized HTTP requests can be made that may expose cached response data and internal services.