CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Other sources
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42018?
CVE-2026-42018 has a high severity rating of 7.5.
How do I fix CVE-2026-42018?
To fix CVE-2026-42018, ensure that anonymous access is properly configured and do not allow unauthenticated users to generate internal tokens.
What is the risk of CVE-2026-42018?
CVE-2026-42018 carries a risk score of 43.
What systems are affected by CVE-2026-42018?
CVE-2026-42018 affects JFrog Artifactory installations.
Is anonymous user token generation exposed in CVE-2026-42018?
Yes, CVE-2026-42018 exposes internal anonymous-user token generation to unauthenticated calls when anonymous access is disabled.