JFrog Artifactory leaks token, actively exploited (CVE-2026-42018)

Actively exploited in the wild - CVE-2026-42018 is a high-severity token disclosure in JFrog Artifactory that returns an internal anonymous-user token to unauthenticated callers even when anonymous access is disabled, granting attackers access to sensitive resources. Upgrade to a patched Artifactory release immediately.

Overview

CVE-2026-42018 affects JFrog Artifactory, the widely deployed artifact repository manager used to store build artifacts, container images, and dependency packages. When anonymous access is turned off, the platform is expected to deny unauthenticated requests outright. Instead, in affected versions, Artifactory can hand back an internal anonymous-user token to any caller who reaches the endpoint without credentials.

That token is meant for internal use only. Its exposure means an unauthenticated attacker receives a credential that the platform itself trusts, opening the door to resources that administrators believed were locked down behind disabled anonymous access.

The CVSS score of 7.5 reflects a network-reachable issue with low attack complexity, no privileges required, and no user interaction. In practical terms, an attacker only needs network access to the Artifactory instance. There is nothing to trick a user into doing and no account to obtain first.

Impact

The core risk is unauthorized access to repository content and metadata that should require authentication. Depending on configuration, that exposure can include proprietary binaries, internal packages, configuration data, and references to other sensitive resources. Because the leaked token is treated as an anonymous-user credential, it can also undermine audit trails: activity performed with it may appear as legitimate anonymous traffic rather than an intrusion.

CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score sits at roughly 0.3 percent, indicating that broad opportunistic scanning is currently low. That low probability should not be read as safety. Targeted actors already have a working method, and any internet-facing Artifactory instance is a candidate.

Remediation and Mitigation

• Upgrade Artifactory to the latest patched release from JFrog. Check the vendor advisory for the exact fixed version that corresponds to your deployment line.
• If you cannot patch immediately, restrict network access to the Artifactory instance. Place it behind a VPN, an allowlist, or a reverse proxy that enforces authentication before requests reach the application.
• Audit logs for requests made with the anonymous-user token, particularly from unexpected source addresses, and rotate any credentials or tokens that may have been exposed as a result.
• Review repository permissions to confirm that no internal-only artifacts are reachable via anonymous or anonymous-derived credentials.

Organizations tracking active exploitation of enterprise tooling can follow ongoing coverage at security news and review incident write-ups at breach reports.

Security Insight

This CVE is a reminder that “authentication disabled” is a configuration state, not a security boundary, unless every code path honors it. Artifactory is a high-value target precisely because it sits at the center of the software supply chain, holding the artifacts that downstream builds trust. A token leak here is not just a data exposure; it is a potential foothold for tampering with what gets shipped to production. Vendors that gate anonymous access must treat token issuance as a security-critical branch and test it as rigorously as login itself.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs