CVE-2026-42018

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS probability

0.92%

CISA KEV

Known exploited vulnerability

CWE

CWE-287

Published

2026-08-12

Last modified

2026-09-12

Affected products

• jfrog artifactory
• jfrog artifactory
• jfrog artifactory
• jfrog artifactory
• jfrog artifactory

Weakness type

• CWE-287

Related vulnerabilities

• CVE-2026-82329 — Potential authentication bypass leading to administrative access in Artifactory
• CVE-2026-85595 — Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
• CVE-2026-68569 — Apache Tomcat: Principal lookup can fail open in some cases
• CVE-2026-19977 — EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication
• CVE-2026-59500 — Priority - CWE-287: Improper Authentication
• CVE-2026-82695 — Tenda AC18 Telnet telnet missing authentication
• CVE-2026-82694 — Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication
• CVE-2026-82693 — Tenda AC1206 Web UI telnet TendaTelnet missing authentication

Markdown version · Browse all CVEs