CVE-2026-42018: JFrog Artifactory Anonymous-Token Exposure (KEV)

CVE-2026-42018 is an improper-authentication flaw in JFrog Artifactory that can hand an unauthenticated caller a valid internal anonymous-user token even when anonymous access is disabled, and attackers used it in the wild as the first step of a chain with a second Artifactory flaw (CVE-2026-42016) to obtain full administrator control of self-hosted instances.

CVE-2026-42018 is an improper authentication vulnerability (CWE-287) in JFrog Artifactory. NVD's Analyzed description states Artifactory "could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources" (NVD).

JFrog's own security-advisories documentation page returned an access error to this page's automated fetch, so this page relies on NVD, CISA's KEV catalog and independent security research for vendor-side detail instead of quoting JFrog directly — the same substitution already used on this site's page for the companion flaw, CVE-2026-42016. Cloud security researcher Wiz published a detailed write-up describing how attackers exploit this flaw: a POST request to Artifactory's AWS-token endpoint with a trailing slash returns HTTP 200 and a JWT for the internal anonymous user, bypassing the disabled-anonymous-access setting. Wiz describes attackers then exchanging that low-privileged token at the tokens API for an administrator-scoped token by abusing CVE-2026-42016 — which validates a token's signature and issuer but not its intended scope — "completing this chain in under five minutes" to establish persistent admin accounts. Wiz observed this exact two-CVE chain exploited in the wild between 2026-08-15 and 2026-09-08, with attackers deploying custom Rust-based backdoors, creating persistent admin accounts, installing malicious Groovy plugins, and exfiltrating credentials and Artifactory Access signing keys (Wiz: Artifactory Under Attack).

NVD lists only a Secondary CVSS v3.1 score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) submitted by the JFrog CNA; NVD has not published its own independent Primary score, so the 7.5 here is JFrog's own rating, not an NVD-confirmed figure (NVD). Taken alone this score reads as a confidentiality-only information-exposure bug, but it understates real-world risk because it does not account for the documented chain with CVE-2026-42016, which turns the leaked token into full administrative compromise.

CISA added CVE-2026-42018 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-11, with a required-action due date of 2026-09-25 — the same day and due date as the companion CVE-2026-42016 — and the catalog records known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.098 (95.5th percentile) (FIRST EPSS).

Because the two CVEs form a single real-world attack chain, JFrog Artifactory Self-Hosted instances must be patched past both affected-version ranges together; patching only one of the two leaves the chain exploitable. Wiz's guidance also recommends enumerating and revoking unexpected administrator-scoped or non-expiring tokens, investigating any token activity attributed to anonymous or other low-privilege identities, and rotating the Artifactory join key and master key after any suspected exposure.

• Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. — NVD
• Attackers chain CVE-2026-42018's leaked anonymous token with CVE-2026-42016's token-scope bypass to obtain administrator-scoped tokens in under five minutes; observed exploited in the wild 2026-08-15 through 2026-09-08 with backdoors, persistent admin accounts, malicious Groovy plugins and key exfiltration. — Wiz: Artifactory Under Attack
• NVD lists only a JFrog CNA Secondary CVSS v3.1 score of 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; no NVD Primary score published. Fixed in Artifactory 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 per branch; Cloud already remediated. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-11, required-action due date 2026-09-25, same batch as companion CVE-2026-42016. — CISA KEV
• EPSS score is 0.098 (95.5th percentile) as of 2026-10-28. — FIRST EPSS