{"id":"CVE-2026-42018","kind":"vulnerability","aliases":["CVE-2026-42018"],"related":[],"title":"JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access…","description":"WAF Release - 2026-09-25 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nSeptember 25, 2026\n\n## WAF Release - 2026-09-25 - Emergency\n\nThis update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits.\n\nKey Findings\n\n- CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files.\n- CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance.\n\nImpact\n\nWe strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers.\n\nDetailed Rule Changes\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...70a43f96 | N/A | Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...909a4db4 | N/A | Wordpress - XSS - Comment | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c797ef03 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a813ac74 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 | N/A | Block | This is a new detection. |","summary":"Unauthenticated POST to the Access service AWS token-exchange endpoint with a trailing slash (/access/api/v1/aws/token/) returns a valid JWT for the internal anonymous user, even with anonymous access disabled. Actively exploited (CISA KEV 11 Sep 2026). Chained with CVE-2026-42016 it gives an admin-scoped token, then persistent admin accounts, malicious Groovy plugins and Rust backdoors. Patching does not remove plugins or accounts already planted.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2026-09-11T00:00:00+00:00","products":[{"name":"JFrog Artifactory","fixed":["7.111.21","7.117.28","7.125.20","7.133.29","7.146.38","7.161.20"],"affected":"< 7.111.21; 7.117.0 - < 7.117.28; 7.125.0 - < 7.125.20; 7.133.0 - < 7.133.29; 7.146.0 - < 7.146.38; 7.161.0 - < 7.161.20","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.111.20"],"affected":"< 7.111.20","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.117.27"],"affected":">= 7.117.0, < 7.117.27","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.125.19"],"affected":">= 7.125.0, < 7.125.19","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.133.28"],"affected":">= 7.133.0, < 7.133.28","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.146.8"],"affected":">= 7.146.0, < 7.146.8","ecosystem":"vendor"},{"name":"JFrog Artifactory","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","exploited","jfrog-artifactory","kev","lab-disclosure","self-hosted","vendor"],"not_affected_if":["anonymous-access-enabled","jfrog-cloud","managed-hosting"],"how_to_check":"Check the version under Administration > Platform > Version, or GET /artifactory/api/system/version. Self-hosted below 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 (on its own release line) is affected. Look in access/request logs for POST /access/api/v1/aws/token/ and POST /access/api/v1/tokens returning 200 from unknown IPs. List admin users for unexpected accounts. Inspect $JFROG_HOME/var/etc/artifactory/plugins/ for unknown .groovy files (rce, cmd, jwtToken, uploadFile, JFrogImage). If the instance was exposed while vulnerable, assume compromise.","fix":"Upgrade self-hosted Artifactory to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 or later on your release line. The lowest numbers in JFrog's own table are 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8. After upgrading, remove rogue admin users and unknown Groovy plugins, and rotate Access signing keys, the join key, stored remote-repo/LDAP credentials and tokens. Until patched, block external access to /access/api/v1/aws/token/.","status":"open","published_at":"2026-08-12T18:17:29+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:33+00:00","updated_at":"2026-10-24T17:31:12+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:31:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"JFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled. An attacker can use that token to reach resources the instance was meant to keep private.","category":"vendor","who_cares":["jfrog-artifactory","self-hosted"],"confidence":0.6,"analyst_note":"Find the JFrog advisory and affected/fixed version ranges, and the mitigation for self-hosted instances; the KEV entry gives no versions. Check whether the JFrog Cloud/SaaS status page covers this.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","anonymous-access-enabled"],"severity_if_unknown":"high"},"cost_usd":0.000354,"input_tokens":2210,"output_tokens":265,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the JFrog advisory and affected/fixed version ranges, and the mitigation for self-hosted instances; the KEV entry gives no versions. Check whether the JFrog Cloud/SaaS status page covers this.","search":"'-09':122C,139C '-2026':19A,22A,91B,174C,213C,216C,291C,326C,346C '-25':123C,140C '-42016':92B '-42018':20A,23A,214C,327C '-82329':217C,347C '-87902':175C,292C '/access/api/v1/aws/token':66B '11':85B '2026':87B,121C,135C,138C '25':134C '70a43f96':281C '909a4db4':303C 'a813ac74':338C 'access':17A,55B,79B,237C 'account':103B,116B 'achiev':235C 'action':274C,276C 'activ':81B 'admin':97B,102B 'admin-scop':96B 'administr':247C 'affect':150C,188C,222C 'allow':227C 'alreadi':117B 'anonym':8A,16A,74B,78B 'anonymous-us':7A 'appli':248C 'arbitrari':198C 'artifactori':2A,42B,154C,224C,240C,257C,321C,341C 'artifactory':25A,27A,29A,31A,33A,35A,37A 'attack':191C,229C 'authent':168C,219C,322C,342C 'aw':57B 'backdoor':109B 'block':294C,309C,329C,349C 'bypass':169C,220C,231C,323C,343C 'c797ef03':318C 'caller':14A 'chain':88B 'chang':265C 'changelog':125C,126C 'cisa':83B 'cloudflar':38B,132C,278C,300C,315C,335C 'comment':277C,307C 'configur':207C 'control':233C 'could':3A 'critic':148C,218C 'cross':163C 'cross-sit':162C 'cve':18A,21A,90B,173C,212C,215C,289C,290C,324C,325C,344C,345C 'data':208C 'defens':146C 'descript':272C 'detail':263C 'detect':299C,314C,334C,354C 'disabl':80B 'disclosur':46B 'emerg':124C,141C 'endpoint':61B 'even':76B 'exchang':60B 'exploit':39B,82B,170C,193C,226C 'expos':205C 'file':159C,184C,199C,211C,287C 'find':172C 'flaw':195C 'fulli':259C 'give':94B 'groovi':105B 'high':178C 'high-sever':177C 'host':49B,202C 'id':268C,271C 'immedi':145C 'impact':242C 'improv':130C 'includ':155C 'inclus':160C,185C,288C 'instanc':241C 'intern':6A,73B 'jfrog':1A,24A,26A,28A,30A,32A,34A,36A,41B,153C,223C,256C,320C,340C 'jfrog-artifactori':40B 'jwt':70B 'kev':43B,84B 'key':171C 'lab':45B 'lab-disclosur':44B 'latest':250C 'legaci':269C 'lfi':161C,186C 'local':158C,183C,286C 'malici':104B 'manag':279C,301C,316C,336C 'n/a':282C,293C,304C,308C,319C,328C,339C,348C 'new':127C,275C,298C,313C,333C,353C 'origin':261C 'patch':110B,252C 'path':156C,180C,284C 'persist':101B 'plant':118B 'plugin':106B,114B 'post':52B 'potenti':204C 'previous':273C 'provid':144C 'read':197C 'recommend':245C 'releas':120C,137C 'remov':113B 'return':4A,67B 'rule':264C,267C,270C 'ruleset':266C,280C,302C,317C,337C 'rust':108B 'scope':98B 'script':165C 'secur':232C,260C 'self':48B 'self-host':47B 'sensit':206C 'sep':86B 'septemb':133C 'server':203C,262C 'servic':56B 'sever':179C 'site':164C 'slash':65B 'strong':244C 'success':225C 'system':210C 'token':10A,59B,99B 'token-exchang':58B 'trail':64B 'travers':157C,181C,285C 'unauthent':13A,51B,190C,228C 'unauthor':236C 'updat':128C,143C 'user':9A,75B 'valid':69B 'vendor':50B,251C 'vulner':149C,187C,221C 'waf':119C,136C 'wordpress':151C,189C,254C,283C,305C 'xss':166C,306C","nicknames":[],"mitigations":[{"kind":"waf-rule","since":"2026-09-25","covers":"HTTP requests proxied through Cloudflare matching the JFrog Artifactory authentication bypass rule for CVE-2026-42018 (Cloudflare Managed Ruleset rule ...c797ef03)","limits":"Traffic not proxied through Cloudflare; origin servers reachable directly; non-HTTP paths","source":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:12Z","confidence":0.9,"source_title":"Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog","customer_action":"Apply the latest JFrog Artifactory vendor patch to fully secure origin servers, as Cloudflare recommends"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-12T18:17:29+00:00","kev":{"dateAdded":"2026-09-11","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"reefs@jfrog.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-42018","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018","severity":null,"published_at":"2026-09-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42018:119","url":null,"severity":null,"published_at":"2026-10-23T21:38:36+00:00","modified_at":"2026-10-23T21:38:36+00:00","first_seen_at":"2026-10-23T21:38:36+00:00","fetched_at":"2026-10-23T21:38:36+00:00","note":"JFrog advisory table (docs.jfrog.com) lists original ranges (<7.111.20, 7.117.0-7.117.27, 7.125.0-7.125.19, 7.133.0-7.133.28, 7.146.0-7.146.8). Wiz (corrected 11 Sep) and Tenable give higher fixed versions incl. 7.161.x; I used those as the safe target. The two sets disagree and I did not find the JFrog page's reason; check JFrog before relying on the lower ones. Wiz saw in-the-wild chaining with CVE-2026-42016 from 15 Aug; no public PoC link found. JFrog Cloud auto-remediated per Wiz, via a search summary only; I did not read a JFrog SaaS page. I did not search social posts."},{"source":"nvd","external_id":"CVE-2026-42018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42018","severity":null,"published_at":"2026-08-12T18:17:29+00:00","modified_at":"2026-10-23T19:10:00+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/#CVE-2026-42018","url":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/","severity":null,"published_at":"2026-09-25T17:18:07+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog"}],"documents":[{"id":1051,"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","title":"JFrog Security Advisories (CVE-2026-66384: <7.146.35; 7.161.0-7.161.16)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1054,"url":"https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201","title":"Wiz: Artifactory Under Attack (in-the-wild exploitation)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1160,"url":"https://www.tenable.com/plugins/was/115474","title":"Tenable: Artifactory Anonymous User Token Disclosure (fixed versions)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1161,"url":"https://www.ionix.io/threat-center/cve-2026-42018/","title":"IONIX: CVE-2026-42018 technical details","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2845,"url":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/","title":"Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-09-25 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nSeptember 25, 2026\n\n## WAF Release - 2026-09-25 - Emergency\n\nThis update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits.\n\nKey Findings\n\n- CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files.\n- CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance.\n\nImpact\n\nWe strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers.\n\nDetailed Rule Changes\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...70a43f96 | N/A | Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...909a4db4 | N/A | Wordpress - XSS - Comment | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c797ef03 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a813ac74 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 | N/A | Block | This is a new detection. |","published_at":"2026-09-25T17:18:07+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}