CVE-2026-42018JFrog Artifactory hands its internal anonymous-user token to unauthenticated callers
What broke
JFrog's advisory, published August 12, 2026, says Artifactory "could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled." The CWE is CWE-287 (improper authentication). Self-hosted versions before 7.111.20 are affected, along with ranges on the 7.117, 7.125, 7.133 and 7.146 branches; JFrog lists a fixed build for each branch and says JFrog Cloud needs no action. NVD shows only the CNA (JFrog) score, CVSS 3.1 7.5.
Wiz reported on September 10, 2026 that attackers chained this flaw with CVE-2026-42016, a scope check that Artifactory skipped. "Neither vulnerability grants administrative control on its own." Together they turned one unauthenticated request into an admin-scoped token. Wiz says attackers then created persistent admin accounts, ran commands through plugins and dropped binaries in /tmp and /dev/shm. One malicious Groovy plugin pulled LDAP settings, Crowd configuration and remote repository credentials, and another read the Access token signing key. CISA added it to KEV on September 11, 2026.
Why it matters
Turning anonymous access off is supposed to mean no identity exists for a caller who did not log in. Here the internal identity still existed and the server issued its access token to anyone who asked. Artifactory is also an identity store in its own right: its configuration holds LDAP settings, Crowd configuration and the credentials it uses to pull from remote repositories, and it signs the tokens that build pipelines present to it.
What to do
- Upgrade to the fixed build for your branch from JFrog's advisory list.
- Restrict network access to Artifactory, starting with internet-facing instances.
- Hunt for the pattern Wiz gives: a 401 on
/access/api/v1/aws/token/followed shortly by a 200 on a variant of that path from the same client.
After you patch
- Upgrading does not remove attacker accounts, plugins or stolen keys. Remove unknown admin users and plugins, then reset the Access token certificate so forged tokens stop validating.
- Rotate the LDAP bind password, Crowd application credentials and remote repository credentials stored in Artifactory.
Sources
Related identity CVEs
Related on Start with Identity
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- CVECheck Point SmartConsole login hands an unauthenticated attacker an admin token
A flaw in the Check Point SmartConsole login process let an unauthenticated attacker obtain an application login token and sign in to the Management Server as a
- CVEIvanti Endpoint Manager authentication bypass leaks stored credentials
An authentication bypass in Ivanti Endpoint Manager before 2024 SU5 let an unauthenticated remote attacker read specific stored credential data. Patched Februar
- BlogA hijacked AI coding assistant session spread Shai-Hulud to about 100 internal repositories
Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stol
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogCrowdSec kept a departing engineer's GitHub access open, and lost 170 private repositories through it
An engineer's laptop was infected in the May TanStack npm attack. Eleven days later his still-active GitHub OAuth token was used to copy about 170 of CrowdSec's