JFrog Artifactory’s support for Terraform remote repositories is vulnerable to Server‑Side Request Forgery. When granted access, a user can trigger Artifactory to send outbound HTTP requests to arbitrary URLs and retrieve the response payload. This flaw can lead to internal network probing, data leakage, or the incorporation of malicious content into the repository, thereby compromising data confidentiality and integrity. The weakness is identified as CWE‑918.

The affected product is JFrog Artifactory. Version details are not disclosed in the advisory, so any installation that supports Terraform remote repositories may be vulnerable. An authenticated user has the necessary capability, and if anonymous access is enabled the flaw can be exploited by unauthenticated users.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score of < 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is administrative, requiring account privileges or anonymous repository access. Exploit requires authenticated access to Artifactory or enabling anonymous access; once triggered, the attacker can direct Artifactory to contact arbitrary external domains, potentially leaking internal network information or fetching sensitive data.