CVE-2026-42018: JFrog Artifactory improper authentication leaks anonymous token

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated disclosure of an internal token with high confidentiality impact and is listed in CISA KEV with confirmed in-the-wild exploitation, though EPSS is low.

What it is

JFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Because the token is meant for internal use, its disclosure can expose sensitive resources that should require authentication. The flaw is an improper authentication issue (CWE-287) rated CVSS 3.1 7.5 High.

Impact

An unauthenticated attacker obtains an internal anonymous-user token and can use it to reach resources that the token is authorized for, gaining read access to sensitive data. The CVSS vector shows high confidentiality impact with no integrity or availability impact.

Attack surface

Reachable over the network with no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N). Any caller able to send requests to the affected Artifactory service can attempt to trigger the token disclosure.

Exploitation

CVE-2026-42018 is listed in CISA KEV with a due date of 2026-09-25, and a third-party advisory reference describes Artifactory exploitation in the wild. EPSS is low (0.0092, 58th percentile), but KEV listing indicates confirmed real-world exploitation.

What to do

• Apply the vendor fix from the JFrog security advisories and self-managed release notes; patch to a release that corrects the anonymous token handling.
• If patching cannot be completed by the CISA due date, follow CISA BOD 26-04 guidance, including discontinuing use of the product where mitigations are unavailable.
• Restrict network access to Artifactory management and API endpoints so only trusted networks or users can reach them.
• Review and tighten anonymous access configuration, and audit for any internal tokens that may have been exposed.
• Monitor vendor advisories for updated guidance, as the record does not specify affected versions.

Detection

• Search Artifactory access and audit logs for unauthenticated requests that receive token material or unexpected anonymous-user token issuance.
• Alert on anonymous-user token use against resources that normally require authentication, especially from unfamiliar source IPs.
• Hunt for requests to Artifactory endpoints from external or untrusted networks that correlate with token retrieval responses.
• Correlate Artifactory token issuance events with subsequent access to sensitive repositories or configuration data.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.