JFrog Artifactory Improper Authentication Vulnerability
TL;DR 📌
- JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
- Highest CVSS: 7.5 (High).
- Listed in CISA KEV (2026-09-11) — this is being exploited in the wild.
- Fixed in
7.111.20,7.117.27,7.125.19,7.133.28— upgrade to this release or later. - CVEs: CVE-2026-42018.
What it is
CVE-2026-42018 is an improper authentication flaw in JFrog Artifactory. Under specific conditions, Artifactory returns an internal anonymous-user token to a caller that has not authenticated at all — even when anonymous access has been explicitly disabled on the instance.
The access path is network-based with no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N). An attacker who can reach Artifactory’s network interface can obtain this token without credentials. The CVSS vector shows impact limited to confidentiality (C:H/I:N/A:N), meaning the token can be used to expose sensitive resources but the flaw itself does not directly give an attacker the ability to modify data or disrupt availability.
This sits in Artifactory’s authentication handling rather than in a specific plugin or repository type — the issue is that the “anonymous access disabled” control does not fully prevent an anonymous-equivalent token from being issued. Anyone relying on disabling anonymous access as a security boundary should treat that boundary as ineffective until patched.
The vulnerability is listed in CISA’s KEV catalogue, added on 2026-09-11, so it is known to be exploited.
What to do
- Patch to one of the fixed versions listed on the NVD advisory: 7.111.20, 7.117.27, 7.125.19, 7.133.28, or 7.146.8 — pick the fix matching your current release line.
- Because this is in KEV, treat patching as urgent rather than routine; federal agencies and anyone following KEV timelines should prioritise this above standard patch cycles.
- After patching, review Artifactory access logs for token issuance to unauthenticated or unexpected sources, particularly around repositories or endpoints holding sensitive artefacts, since the flaw could have been used to read data even where anonymous access was believed to be off.
- Confirm anonymous access settings post-patch and re-verify that the control behaves as configured — don’t assume the setting alone is sufficient without the fix applied.
- Restrict network exposure of the Artifactory management and API endpoints where possible while patching is scheduled, since the flaw requires only network reachability and no credentials.
For leadership 🧭
Executive summary. JFrog Artifactory instances that disabled anonymous access as a security control are not actually protected: an unauthenticated network caller can still obtain a working token and read sensitive stored artefacts. This is in CISA’s KEV list as known to be exploited, so patching should be treated as urgent rather than scheduled into a routine cycle.
Why it matters:
- The flaw defeats the specific control organisations use to lock down Artifactory — disabling anonymous access — so any instance relying on that setting alone is exposed regardless of configuration.
- Exploitation needs only network reachability to Artifactory, no credentials and no user interaction, meaning any exposed interface is a viable access path.
- Confidentiality impact is high: the issued token can be used to pull sensitive artefacts, though it does not by itself allow modification or deletion of repository contents.
- The vulnerability is in CISA’s KEV catalogue as known to be exploited, so unpatched instances face active risk rather than theoretical exposure.
Now / Next / Later:
- Now: Identify all Artifactory instances and check their release against the fixed versions (7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8), prioritising any reachable from untrusted networks.
- Next: Patch each instance to the fixed version matching its release line, then confirm anonymous access settings behave as configured post-patch.
- Later: Review Artifactory access logs for token issuance to unauthenticated callers around sensitive repositories, and restrict network exposure of management and API endpoints so authentication controls aren’t the sole line of defence.