CVE Details

CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability
Published: 2026-09-11 CVSS: 7.5 HIGH Product: JFrog Artifactory Due Date: 2026-09-25

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

No GitHub PoC data.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 7.5
  • Severity: HIGH
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

  • Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-42018
cveMetadata > assignerOrgId 48a46f29-ae42-4e1d-90dd-c1676c1e5e6d
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName JFROG
cveMetadata > dateReserved 2026-04-23T13:41:13.755Z
cveMetadata > datePublished 2026-08-12T17:43:21.289Z
cveMetadata > dateUpdated 2026-09-11T19:58:24.026Z
containers > cna > providerMetadata > orgId 48a46f29-ae42-4e1d-90dd-c1676c1e5e6d
containers > cna > providerMetadata > shortName JFROG
containers > cna > providerMetadata > dateUpdated 2026-08-18T18:14:10.646Z
containers > cna > title Anonymous user token generation exposure in JFrog Artifactory
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-287
containers > cna > problemTypes > 0 > descriptions > 0 > description CWE-287 Improper Authentication
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > affected > 0 > vendor jfrog
containers > cna > affected > 0 > product artifactory
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 0
containers > cna > affected > 0 > versions > 0 > lessThan 7.111.20
containers > cna > affected > 0 > versions > 0 > versionType custom
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > version 7.117.0
containers > cna > affected > 0 > versions > 1 > lessThan 7.117.27
containers > cna > affected > 0 > versions > 1 > versionType custom
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > version 7.125.0
containers > cna > affected > 0 > versions > 2 > lessThan 7.125.19
containers > cna > affected > 0 > versions > 2 > versionType custom
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 3 > version 7.133.0
containers > cna > affected > 0 > versions > 3 > lessThan 7.133.28
containers > cna > affected > 0 > versions > 3 > versionType custom
containers > cna > affected > 0 > versions > 4 > status affected
containers > cna > affected > 0 > versions > 4 > version 7.146.0
containers > cna > affected > 0 > versions > 4 > lessThan 7.146.8
containers > cna > affected > 0 > versions > 4 > versionType custom
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
containers > cna > descriptions > 0 > supportingMedia > 0 > type text/html
containers > cna > descriptions > 0 > supportingMedia > 0 > base64 False
containers > cna > descriptions > 0 > supportingMedia > 0 > value <p>JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.</p>
containers > cna > references > 0 > url https://docs.jfrog.com/releases/docs/jfrog-security-advisories
containers > cna > references > 0 > tags > 0 vendor-advisory
containers > cna > references > 1 > url https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
containers > cna > references > 1 > tags > 0 vendor-advisory
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact NONE
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact NONE
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity HIGH
containers > cna > metrics > 0 > cvssV3_1 > baseScore 7.5
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
containers > cna > credits > 0 > lang en
containers > cna > credits > 0 > value Daniil Vylegzhanin (NetSPI)
containers > cna > credits > 0 > type finder
containers > cna > source > discovery EXTERNAL
containers > cna > x_generator > engine Vulnogram 1.0.4
containers > adp > 0 > references > 0 > url https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
containers > adp > 0 > references > 0 > tags > 0 third-party-advisory
containers > adp > 0 > references > 1 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018
containers > adp > 0 > references > 1 > tags > 0 government-resource
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-08-13T15:05:05.752699Z
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-42018
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation none
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable yes
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact partial
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 1 > other > type kev
containers > adp > 0 > metrics > 1 > other > content > dateAdded 2026-09-11
containers > adp > 0 > metrics > 1 > other > content > reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-09-11T19:58:24.026Z
containers > adp > 0 > timeline > 0 > time 2026-09-11T00:00:00.000Z
containers > adp > 0 > timeline > 0 > lang en
containers > adp > 0 > timeline > 0 > value CVE-2026-42018 added to CISA KEV