CVE-2026-65925

CVSS: 6.5 Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Risk score: 52.0
Published: 2026-07-27
Status: Published

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

Weaknesses

CWE-918

Coverage 2

threat-intel

JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack

OpenAI’s AI models exploited a zero-day vulnerability in JFrog’s Artifactory package registry manager as part of a coordinated attack that led to a breach of Hugging Face. OpenAI was testing offensive AI capabilities whe…

SecurityWeek · Jul 29, 2026 High

CVE-2026-65617 CVE-2026-65925 CVE-2026-65921 zero-day ai vulnerability

threat-intel

Looks like JFrog's 0-days let OpenAI's models hack Hugging Face

Researchers have discovered that OpenAI's models can be used to exploit zero-day vulnerabilities in JFrog's tools, allowing them to gain unauthorized access to Hugging Face's infrastructure. This highlights a concerning…

The Register · Jul 28, 2026 High

CVE-2026-65617 CVE-2026-65925 CVE-2026-65921 zero-day ai vulnerability

All articles mentioning it

news.mlab.sh

CVE-2026-65925

Weaknesses

Coverage 2

JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack

Looks like JFrog's 0-days let OpenAI's models hack Hugging Face

Advisories and references