JFrog Artifactory Improper Authentication Vulnerability

Published September 10, 2026 CVE-2026-42018

JFrog Artifactory, the tool companies use to store and manage their software packages, can hand out a hidden internal access token to a stranger who never logged in. This happens even when the administrator has turned off anonymous access, so it can expose data the company thought was locked down.

Severity
HighCVSS 3.1 · 7.5
Fix
Not confirmedLast checked today
Affected versions
before 7.111.20; 7.117.0 to before 7.117.27; 7.125.0 to before 7.125.19+2 more
Weakness
CWE-287Improper Authentication
Exploit likelihood
0.35% in 30 daysEPSS, higher than 28% of known flaws
Affects
Artifactory
Exploited
Yes, in the wildListed by CISA
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: partial
EU ID
EUVD-2026-57388ENISA vulnerability database
Added to CISA list
Sep 11, 2026
Federal fix deadline
Sep 25, 2026

How it works

  • An Artifactory administrator can disable anonymous access to keep unauthenticated visitors out of the server.
  • Internally, Artifactory still creates a token for its built-in anonymous account to handle background operations.
  • A flaw in how that token is issued lets it leak to a caller who never authenticated at all.
  • Because the setting was supposed to block exactly this kind of access, the caller ends up able to reach resources the administrator believed were protected.
  • JFrog has not published further detail on which specific request triggers the leak.

What to do

Open your Artifactory admin console or About page and find the exact build number your server is running. Compare it against the affected ranges: before 7.111.20, 7.117.0 up to 7.117.26, 7.125.0 up to 7.125.18, 7.133.0 up to 7.133.27, or 7.146.0 up to 7.146.7. If you deliberately disabled anonymous access on that server, treat a match against these ranges as a priority since the flaw specifically undermines that setting.

Update Artifactory to the fixed build for your branch: 7.111.20, 7.117.27, 7.125.19, 7.133.28, or 7.146.8. Check JFrog's security advisories page for the release matching your branch and any added mitigation notes. Prioritize this update, since CVE-2026-42018 was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-11.

Technical details

CVE-2026-42018 is an improper authentication flaw (CWE-287) in JFrog Artifactory, scoring 7.5 (high) under CVSS 3.1 with network access, low complexity, no privileges, and no user interaction required, giving high confidentiality impact but no integrity or availability impact. At publication JFrog's CISA-coordinated assessment listed exploitation status as 'none,' but the CVE was added to the CISA KEV catalog on 2026-09-11. Fixed builds are 7.111.20, 7.117.27, 7.125.19, 7.133.28, and 7.146.8 across their respective branches.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source