Anonymous user token generation exposure in JFrog Artifactory (CVE-2026-42018)

What is affected, what to do

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

The vulnerability is being actively exploited; treat it as a priority. Update JFrog Artifactory to version 7.111.20, JFrog Artifactory to version 7.117.27, JFrog Artifactory to version 7.125.19. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• JFrog Artifactory lt *..7.111.20
• JFrog Artifactory lt 7.117.0..7.117.27
• JFrog Artifactory lt 7.125.0..7.125.19
• JFrog Artifactory lt 7.133.0..7.133.28
• JFrog Artifactory lt 7.146.0..7.146.8

Fixed in

• JFrog Artifactory 7.111.20
• JFrog Artifactory 7.117.27
• JFrog Artifactory 7.125.19
• JFrog Artifactory 7.133.28
• JFrog Artifactory 7.146.8

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch: Upgrade Artifactory to the fixed build of your release line: 7.111.20, 7.117.27, 7.125.19, 7.133.28 or 7.146.8. Confirm the running version via GET /artifactory/api/system/version or "Administration → Platform Monitoring". For JFrog Cloud (SaaS), get the patch status confirmed by JFrog support.
   • Cut exposure now: Until patched, restrict internet-facing Artifactory (HTTP/HTTPS, typically 443, 8081, 8082) to VPN, a bastion host or known CI/CD source IPs. A fronting reverse proxy (nginx, HAProxy) can drop any request that lacks an Authorization header or a valid SSO cookie.
   • Strip the anonymous user's permissions: Remove anonymous, and any group it belongs to, from every permission target ("Administration → User Management → Permissions"). A leaked anonymous token then grants nothing, even though "Allow Anonymous Access" is already off.
   • Rotate secrets: Identify repositories (especially generic, Helm, Docker and Terraform) holding config files, .npmrc, settings.xml, kubeconfigs or certificates that anonymous permissions could read. Rotate the exposed credentials, API keys and access tokens.
   • Preserve evidence: Snapshot request and access logs ($JFROG_HOME/artifactory/var/log/, $JFROG_HOME/access/var/log/) back to at least the release date of the affected builds, before log rotation overwrites them.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Host Artifactory in a build or management zone. Allow inbound traffic only from CI runners, developer VLANs and proxy networks, and drop inbound internet traffic at the perimeter. Remote repositories need outbound connectivity only.
   • Reverse proxy/WAF: Return 401 for requests without Authorization/X-JFrog-Art-Api/session cookie on every path except /artifactory/api/system/ping and the login/SSO endpoints. Log any response that issues a token to a client that has not authenticated.
   • IAM/least privilege: Audit permission targets that use "Any Local", "Any Remote" or "ANY" repositories. Bind read and deploy rights to named groups only, issue admin tokens with short lifetimes, and enforce expires_in on all tokens.
   • Configuration hardening: Under "Administration → Security → General", keep "Allow Anonymous Access" disabled and enable "Hide Existence of Unauthorized Resources". Enforce SAML/OIDC SSO with MFA for interactive logins.
   • Supply-chain integrity: The flaw is confidentiality-only. If anonymous ever held deploy rights, verify critical artefacts anyway: compare checksums against CI build records and validate signatures (cosign, GPG).
3. 03

   Runbook step 3

   Detection rules

   • Artifactory request log: Search artifactory-request.log for user anonymous with HTTP 200 on download or API paths. With anonymous access disabled, any such hit is suspicious. SPL: index=artifactory sourcetype=artifactory:request user="anonymous" status=200 | stats count by src_ip, request_path.
   • Access service logs: In access-request.log/access-audit.log, look for token issuance or token use with subject anonymous. Also flag hits on /access/api/v1/tokens from a source IP with no preceding successful login.
   • Bulk retrieval/enumeration: Flag a single external IP issuing many GETs to /artifactory/api/repositories, /api/storage/, /api/search/ or directory listings. Sigma shape: logsource: artifactory request, selection: path|contains: ['/api/repositories','/api/storage','/api/search'], condition: selection | count() by src_ip > 100 within 10 min.
   • Network telemetry (Zeek/Suricata): Watch for large egress from Artifactory to non-corporate IPs (zeek conn.log: responder is Artifactory, small orig_bytes, large resp_bytes, external originator). Also flag new user agents such as curl, python-requests or Go-http-client from unfamiliar networks.
   • Downstream credential abuse: Flag logins with credentials stored in artefacts to cloud consoles, Kubernetes APIs or registries from atypical locations (Entra ID sign-in logs, AWS CloudTrail ConsoleLogin/AssumeRole).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, BSI WID Portal, BSI CSAF

Vendors and products

• JFrog JFrog Artifactory
• JFrog Artifactory Saas
• JFrog Artifactory Self-managed

Weakness classes (CWE)

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

References & sources

• docs.jfrog.comJFrog Artifactory — CVE-2026-42016Vendor advisory, Vendor advisory, pwn-watch
• docs.jfrog.comreleases/docs/artifactory-self-managed-releasesVendor advisory, Release notes
• wiz.ioblog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2…Third-party advisory, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018government-resource, US government resource
• pwn.watchpwn.watch: JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-42016pwn-watch
• NVD (NIST)NVD: CVE-2026-42018pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 01.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-42018","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-09-11T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-42018","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T18:06:12.895893Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 12.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-42018","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-08-13T15:05:05.752699Z"}	{"id":"CVE-2026-42018","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-09-11T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 11.09.2026NVD analysis modifiedNVD

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018
   • https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018 Types: US Government Resource
   Reference type	added	—	CISA-ADP: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 Types: Third Party Advisory

   Source identifier: nvd@nist.gov

4. 11.09.2026Record modifiedjfrog.com

   New references:

   • https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
   • https://docs.jfrog.com/releases/docs/jfrog-security-advisories
   Show 6 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
   Reference	added	—	https://docs.jfrog.com/releases/docs/jfrog-security-advisories
   Reference	removed	https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases	—
   Reference	removed	https://docs.jfrog.com/releases/docs/jfrog-security-advisories	—
   Reference type	removed	https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases Types: Release Notes	—
   Reference type	removed	https://docs.jfrog.com/releases/docs/jfrog-security-advisories Types: Vendor Advisory	—

   Source identifier: reefs@jfrog.com

5. 11.09.2026Record modifiedCISA ADP

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018
   • https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018
   Reference	added	—	https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.