Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2026-08-12

CVE-2026-42018

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

  1. KEV
  2. 37 days →First PoC

Signals

Exploited in the wild
Yesadded 2026-09-11 · due 2026-09-25. An observation, not a forecast.
EPSS · 30-day forecast
10%Chance of exploitation in the next 30 days, 96th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH
7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

1 known · links only

Nuclei1

  1. JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass ↗

    JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous access to be disabled.

    yaml · seen 2026-10-18

On the wire

1 dispatch
  1. CISA adds CVE-2026-42018 (JFrog Artifactory) to the Known Exploited Vulnerabilities catalogKEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.