CVE-2026-42018

HIGH

CVE: CVE-2026-42018 - JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potential...Sign in to save

CVSS

7.5

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 12, 2026

Exploitability

No EPSS data available

Description

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Weaknesses

CWE-287

Affected Packages

No package data available.

Aliases

CVE-2026-42018

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
https://docs.jfrog.com/releases/docs/jfrog-security-advisories