CVE-2026-70551 Overview
CVE-2026-70551 is a Server-Side Request Forgery (SSRF) vulnerability affecting JFrog Artifactory version control system (VCS) repository handling. An authenticated user with read access to an existing remote VCS repository can replace the configured origin or supply an absolute VCS data URL. The flaw is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Attackers with low-privileged access can coerce Artifactory into issuing requests to arbitrary destinations, exposing internal services and sensitive data reachable from the server.
Affected Products
- JFrog Artifactory Self-Managed (remote VCS repository feature)
- JFrog Artifactory Cloud deployments exposing VCS remote repositories
- Any Artifactory instance permitting user-controlled VCS origin configuration
Discovery Timeline
- 2026-08-25 - CVE-2026-70551 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-70551
Vulnerability Analysis
The vulnerability resides in how Artifactory processes remote VCS repository configuration. A user holding read access can modify the configured origin of an existing repository or provide an absolute VCS data URL. Artifactory then dereferences the attacker-supplied URL server-side without adequate validation of the destination.
This behavior enables Server-Side Request Forgery. The Artifactory service, which typically runs with elevated network trust, can be redirected to internal hosts, cloud metadata endpoints, or other services unreachable from the attacker's location. The scope-change component of the impact reflects that the attacker leverages Artifactory's identity to reach protected resources.
Root Cause
The root cause is insufficient authorization and input validation on VCS origin and data URL fields. Read-level permissions should not authorize origin reconfiguration, and absolute URLs should be constrained through an allowlist. The absence of these controls permits [CWE-918] SSRF conditions.
Attack Vector
An authenticated attacker with read access to any remote VCS repository submits a modified origin URL or an absolute VCS data URL pointing to an internal target. Artifactory issues the outbound request from its own network context. Responses or timing signals can be inspected to enumerate internal hosts, retrieve cloud credentials from instance metadata services, or interact with unauthenticated internal APIs.
Exploitation requires only network reachability to Artifactory and valid low-privileged credentials. No user interaction is needed. See the JFrog Security Advisories for vendor-specific technical detail.
Detection Methods for CVE-2026-70551
Indicators of Compromise
- Outbound HTTP requests from Artifactory nodes to internal RFC1918 addresses or cloud metadata endpoints such as 169.254.169.254
- Audit log entries showing VCS remote repository origin URL modifications by non-administrative accounts
- Requests to VCS data URLs that resolve to hosts outside expected upstream providers such as github.com, gitlab.com, or bitbucket.org
Detection Strategies
- Monitor Artifactory access logs for PATCH or POST operations against /api/repositories/{repoKey} where the request body alters the url field
- Baseline expected VCS upstream destinations and alert on deviations
- Correlate authenticated Artifactory sessions with unusual outbound network flows originating from the Artifactory service account
Monitoring Recommendations
- Enable Artifactory request and audit logging and forward events to a centralized analytics platform for correlation
- Instrument egress traffic from Artifactory hosts to detect connections to metadata services and internal management interfaces
- Review VCS repository configuration change history on a recurring cadence
How to Mitigate CVE-2026-70551
Immediate Actions Required
- Restrict remote VCS repository management permissions to trusted administrators only
- Audit existing VCS repositories for unexpected origin URLs and revert unauthorized changes
- Block egress from Artifactory hosts to cloud metadata endpoints and internal management networks at the network layer
Patch Information
Apply the latest fixed release from JFrog. Refer to the JFrog Artifactory Release Documentation for the current patched version and upgrade procedures, and the JFrog Security Advisories for advisory-specific guidance.
Workarounds
- Remove read access on remote VCS repositories from untrusted user groups until patching is complete
- Deploy an egress proxy that enforces an allowlist of permitted VCS upstream hostnames for Artifactory
- Enforce IMDSv2 on AWS-hosted Artifactory instances to reduce metadata service exposure
# Example egress allowlist (iptables) restricting Artifactory outbound to known VCS providers
iptables -A OUTPUT -m owner --uid-owner artifactory -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner artifactory -p tcp --dport 443 -d github.com -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner artifactory -p tcp --dport 443 -d gitlab.com -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner artifactory -p tcp --dport 443 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
