CVE-2019-9733: JFrog Artifactory access-admin IP whitelist bypass via X-Forwarded-For

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable authentication bypass with public exploit code and a CVSS of 9.8 that yields full control of the artifact repository.

What it is

Artifactory 6.7.3 restricts the access-admin password-reset account to connections from localhost, but the whitelist check trusts the X-Forwarded-For header. An unauthenticated attacker can spoof that header, log in with the default access-admin credentials, and use the API to mint authentication tokens for any user, including admin.

Impact

The attacker gains full control of all artifacts and repositories managed by Artifactory, including the ability to impersonate the admin account.

Attack surface

Reachable over the network via HTTP requests to the Artifactory console; no authentication or user interaction is required, only the ability to send a crafted X-Forwarded-For header.

Exploitation

Not listed in CISA KEV, but public exploit references exist (Packet Storm, CipherTechs) and EPSS is 0.52948 (98.9th percentile), indicating high likelihood of exploitation.

What to do

• Upgrade Artifactory to 6.8.6 or later, which addresses this issue per the vendor release notes.
• Change the default access-admin credentials and disable or restrict the access-admin account if not needed.
• Do not trust client-supplied X-Forwarded-For headers; configure the reverse proxy to strip or overwrite them and only accept connections from known proxies.
• Restrict network access to the Artifactory console and API to trusted management networks.
• Rotate all Artifactory user and admin tokens after patching in case of prior compromise.

Detection

• Search Artifactory access logs for requests to the access-admin or password-reset endpoints containing an X-Forwarded-For header.
• Alert on successful logins to the access-admin account, especially from non-localhost source addresses.
• Monitor for API calls that generate authentication tokens for multiple or privileged users in a short window.
• Review audit logs for unexpected token creation or repository permission changes tied to access-admin.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.