CVE-2026-65925

Think of JFrog Artifactory as a “package fetcher” that can pull content from remote places. With this flaw, a user who can read a specific Cargo remote repository can trick Artifactory into fetching from other places they choose, which can expose internal information—like an internal “caller” being forced to visit attacker-controlled destinations.

This matters if your business uses JFrog Artifactory and you have Cargo remote repositories configured in a way that someone can get read access to them. Because the attacker needs read access (not just a public login) and the system must be able to reach external URLs, the risk is highest when Artifactory is reachable by users inside your organization who can view Cargo remote repository settings and when outbound internet access from Artifactory is allowed.

This is RED because exploitation has been reported in real incidents tied to a JFrog Artifactory zero-day, meaning attackers are using this kind of SSRF to gain outbound internet access and move toward high-value targets. Even without a public exploit package, the practical exposure is real when Cargo remote repository read access and outbound connectivity are present.