CVE-2026-65618 | Improper URL validation when handling specific URLs, allows … | CVSS 6.5 MEDIUM

Description

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

Metadata

CVE ID: CVE-2026-65618
State: PUBLISHED
Assigner: JFROG
Reserved: 2026-07-22 12:02 UTC
Published: 2026-07-27 19:32 UTC
Last updated: 2026-07-27 20:06 UTC
Primary CWE: CWE-918
CWE-918 Server-Side Request Forgery (SSRF)
Vendor / Product: jfrog / artifactory
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
jfrog	artifactory	—	0 < 7.133.6

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	CWE-918 Server-Side Request Forgery (SSRF)

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (2)