--- id: "CVE-2026-42018" kind: "vulnerability" aliases: ["CVE-2026-42018"] title: "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access\u2026" severity: "high" cvss: 7.5 epss: null exploited: true status: "open" category: "vendor" products: [{"name": "JFrog Artifactory", "fixed": ["7.111.21", "7.117.28", "7.125.20", "7.133.29", "7.146.38", "7.161.20"], "affected": "< 7.111.21; 7.117.0 - < 7.117.28; 7.125.0 - < 7.125.20; 7.133.0 - < 7.133.29; 7.146.0 - < 7.146.38; 7.161.0 - < 7.161.20", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.111.20"], "affected": "< 7.111.20", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.117.27"], "affected": ">= 7.117.0, < 7.117.27", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.125.19"], "affected": ">= 7.125.0, < 7.125.19", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.133.28"], "affected": ">= 7.133.0, < 7.133.28", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.146.8"], "affected": ">= 7.146.0, < 7.146.8", "ecosystem": "vendor"}, {"name": "JFrog Artifactory", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cloudflare", "exploited", "jfrog-artifactory", "kev", "lab-disclosure", "self-hosted", "vendor"] not_affected_if: ["anonymous-access-enabled", "jfrog-cloud", "managed-hosting"] published_at: "2026-08-12T18:17:29+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T17:31:12+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:38:36+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42018", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/", "first_seen_at": "2026-10-24T17:18:15+00:00"}] --- # JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access… Unauthenticated POST to the Access service AWS token-exchange endpoint with a trailing slash (/access/api/v1/aws/token/) returns a valid JWT for the internal anonymous user, even with anonymous access disabled. Actively exploited (CISA KEV 11 Sep 2026). Chained with CVE-2026-42016 it gives an admin-scoped token, then persistent admin accounts, malicious Groovy plugins and Rust backdoors. Patching does not remove plugins or accounts already planted. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:JFrog Artifactory affected < 7.111.21; 7.117.0 - < 7.117.28; 7.125.0 - < 7.125.20; 7.133.0 - < 7.133.29; 7.146.0 - < 7.146.38; 7.161.0 - < 7.161.20 fixed 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 - vendor:jfrog artifactory affected < 7.111.20 fixed 7.111.20 - vendor:jfrog artifactory affected >= 7.117.0, < 7.117.27 fixed 7.117.27 - vendor:jfrog artifactory affected >= 7.125.0, < 7.125.19 fixed 7.125.19 - vendor:jfrog artifactory affected >= 7.133.0, < 7.133.28 fixed 7.133.28 - vendor:jfrog artifactory affected >= 7.146.0, < 7.146.8 fixed 7.146.8 - vendor:JFrog Artifactory affected ? fixed ? ## How to check Check the version under Administration > Platform > Version, or GET /artifactory/api/system/version. Self-hosted below 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 (on its own release line) is affected. Look in access/request logs for POST /access/api/v1/aws/token/ and POST /access/api/v1/tokens returning 200 from unknown IPs. List admin users for unexpected accounts. Inspect $JFROG_HOME/var/etc/artifactory/plugins/ for unknown .groovy files (rce, cmd, jwtToken, uploadFile, JFrogImage). If the instance was exposed while vulnerable, assume compromise. ## Fix Upgrade self-hosted Artifactory to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 or later on your release line. The lowest numbers in JFrog's own table are 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8. After upgrading, remove rogue admin users and unknown Groovy plugins, and rotate Access signing keys, the join key, stored remote-repo/LDAP credentials and tokens. Until patched, block external access to /access/api/v1/aws/token/. ## Mitigated for you by - Cloudflare (waf-rule, since 2026-09-25): covers HTTP requests proxied through Cloudflare matching the JFrog Artifactory authentication bypass rule for CVE-2026-42018 (Cloudflare Managed Ruleset rule ...c797ef03) Limits: Traffic not proxied through Cloudflare; origin servers reachable directly; non-HTTP paths Still: Apply the latest JFrog Artifactory vendor patch to fully secure origin servers, as Cloudflare recommends https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/ ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018 - 2026-10-23T21:38:36+00:00 analyst — JFrog advisory table (docs.jfrog.com) lists original ranges (<7.111.20, 7.117.0-7.117.27, 7.125.0-7.125.19, 7.133.0-7.133.28, 7.146.0-7.146.8). Wiz (corrected 11 Sep) and Tenable give higher fixed versions incl. 7.161.x; I used those as the safe target. The two sets disagree and I did not find the JFrog page's reason; check JFrog before relying on the lower ones. Wiz saw in-the-wild chaining with CVE-2026-42016 from 15 Aug; no public PoC link found. JFrog Cloud auto-remediated per Wiz, via a search summary only; I did not read a JFrog SaaS page. I did not search social posts. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42018 - 2026-10-24T17:18:15+00:00 lab https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/ — Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog ## Documents - [advisory] JFrog Security Advisories (CVE-2026-66384: <7.146.35; 7.161.0-7.161.16) https://docs.jfrog.com/releases/docs/jfrog-security-advisories - [advisory] Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/ - [describes] Wiz: Artifactory Under Attack (in-the-wild exploitation) https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 - [describes] IONIX: CVE-2026-42018 technical details https://www.ionix.io/threat-center/cve-2026-42018/ - [fix] Tenable: Artifactory Anonymous User Token Disclosure (fixed versions) https://www.tenable.com/plugins/was/115474 ## From the sources WAF Release - 2026-09-25 - Emergency · Changelog # Changelog New updates and improvements at Cloudflare. September 25, 2026 ## WAF Release - 2026-09-25 - Emergency This update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits. Key Findings - CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files. - CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance. Impact We strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers. Detailed Rule Changes | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | --- | --- | --- | --- | --- | --- | --- | | Cloudflare Managed Ruleset | ...70a43f96 | N/A | Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 | N/A | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...909a4db4 | N/A | Wordpress - XSS - Comment | N/A | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...c797ef03 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 | N/A | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...a813ac74 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 | N/A | Block | This is a new detection. | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_