CVE-2026-65924 in Artifactory
Summary
by MITRE • 07/27/2026
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive the response content.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability in JFrog Artifactory's Terraform remote repository support represents a critical server-side request forgery flaw that undermines the security boundaries of the platform. This issue affects the way Artifactory handles requests when processing Terraform modules through remote repositories, creating an attack vector where malicious actors can manipulate the system to make unauthorized outbound connections. The vulnerability exists because the application fails to properly validate and sanitize URLs used in the Terraform repository integration, allowing attackers to construct requests that bypass normal network restrictions and access internal systems or external services.
The technical implementation of this flaw stems from insufficient input validation within the remote repository handling logic. When Artifactory processes Terraform module requests, it performs HTTP operations against configured remote endpoints without adequate sanitization of the target URLs. This allows an authenticated user with appropriate permissions or an unauthenticated user when anonymous access is enabled to inject malicious URLs that point to internal network resources or external attacker-controlled servers. The vulnerability can be exploited through crafted repository configurations or direct manipulation of Terraform module references, enabling attackers to perform reconnaissance, exfiltrate data, or establish command and control channels.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can enable attackers to perform lateral movement within network environments. An attacker who successfully exploits this SSRF vulnerability could potentially access internal services that are normally not exposed to the internet, including database servers, application backends, or other sensitive systems. The attack surface is particularly concerning in enterprise environments where Artifactory serves as a central repository for infrastructure components, as it provides an entry point for attackers to bypass traditional network security controls and gain access to resources that should remain isolated from external threats.
Organizations using JFrog Artifactory with Terraform remote repositories face significant risk from this vulnerability, particularly when anonymous access is enabled or when users have elevated privileges within the system. The flaw aligns with CWE-918 Server-Side Request Forgery (SSRF) which is classified as a high-severity issue in the Common Weakness Enumeration catalog and maps directly to ATT&CK technique T1071.004 Application Layer Protocol: DNS, where adversaries use SSRF to bypass network restrictions and access internal resources. Mitigation strategies include implementing strict URL validation for remote repository configurations, disabling anonymous access where possible, enforcing network segmentation, and applying the latest security patches from JFrog. Additionally, organizations should monitor outbound network connections from Artifactory instances and implement network-based controls to restrict access to known safe destinations while maintaining visibility into all HTTP traffic generated by the system.
The vulnerability demonstrates how modern DevOps toolchains can introduce security risks when integrating with external systems, particularly when authentication mechanisms are not properly enforced or when applications fail to validate user-supplied inputs. This flaw underscores the importance of applying security controls throughout the software development lifecycle and highlights the need for regular vulnerability assessments of infrastructure components that serve as central points of access for development teams. Organizations should also consider implementing automated security scanning tools that can detect similar patterns in other repository implementations or integration points within their infrastructure ecosystems, as this type of vulnerability often indicates broader architectural weaknesses in how external service calls are handled across applications.