CVE-2026-42018highunder attackCWE-287

CVE-2026-42018: high-severity vulnerability in jfrog artifactory

Anonymous user token generation exposure in JFrog Artifactory

Published · Updated

Follow this CVE+ Monitor artifactory

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

66Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 7.5epss 10.0%
from disclosure to weapon33 days
Published on NVDAug 12
1st PoC+33d
CISA KEV+30d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-09-25

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

JFrog Artifactory incorrectly generates and reveals an internal anonymous-user token to unauthenticated users even when anonymous access is supposed to be disabled. This token can be misused to access sensitive resources that should be protected.

Technical detail

When anonymous access is disabled, JFrog Artifactory fails to properly enforce authentication checks and returns an internal anonymous-user token to unauthenticated callers (CWE-287: Improper Authentication). An attacker can obtain this token and use it to access protected resources, bypassing intended access controls. The vulnerability affects availability and confidentiality of restricted artifacts.

Summary generated and translated by AI from the official description.
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
jfrog · artifactory
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — jfrog artifactory

In the same product, most dangerous first.

CVE-2026-82329CRITICALPotential authentication bypass leading to administrative access in ArtifactoryEPSS 14.4%KEVCVE-2026-42016HIGHIncorrect authorization validation of user token in JFrog Artifactory allows Privilege EscalationEPSS 8.6%KEVCVE-2026-66384MEDIUMAuthenticated users may write data outside the intended Docker cache pathEPSS 0.7%KEVCVE-2026-65617HIGHPotential remote code execution on an Artifactory package service container.EPSS 0.6%CVE-2026-66014HIGHPotential authentication bypass leading to privilege escalation in ArtifactoryEPSS 0.6%CVE-2026-65921HIGHPotential path traversal leading to unauthorized file writesEPSS 0.6%