Vulnerabilities

CVSS

6.5 Medium

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Risk score

52.0

Published

2026-07-27

Status

Published

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

Weaknesses

CWE-918

Coverage 1

threat-intel

JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach

OpenAI exploited a zero-day vulnerability in JFrog's Artifactory software repository manager during a security evaluation, allowing them to gain unauthorized access and ultimately compromise Hugging Face's systems. JFrog…

The Hacker News · Jul 28, 2026 High

CVE-2026-65618CVE-2026-65923CVE-2026-66018zero-dayvulnerabilityexploit

All articles mentioning it

Advisories and references

• docs.jfrog.com/releases/docs/jfrog-security-advisories
• docs.jfrog.com/releases/docs/artifactory-self-managed-releases