Auth bypass in Jfrog Artifactory
CVE-2026-42018
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS 0.100, 95.7th percentile (scored ); unchanged over 30 days. About EPSS.
Affected products
- Jfrog Artifactory — versions 0
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Browse the full CISA KEV catalog with PoC counts, Metasploit modules and EPSS.
References
- docs.jfrog.com/releases/docs/jfrog-security-advisories (vendor-advisory, Vendor Advisory)
- docs.jfrog.com/releases/docs/artifactory-self-managed-releases (vendor-advisory, Release Notes)
- www.cisa.gov/known-exploited-vulnerabilities-catalog (US Government Resource)
- www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-4… (Third Party Advisory)
This CVE has public exploit evidence. See the latest CVEs with public exploits.