CVE-2026-42018

What is JFrog Artifactory?

JFrog Artifactory is a binary and artifact repository manager used across CI/CD pipelines to store and serve Docker images and language packages. It is a linchpin of the software supply chain: an attacker with control over Artifactory can tamper with the packages that every downstream build consumes. That leverage makes any authentication weakness in Artifactory a serious risk, especially one reachable without credentials.

Overview

CVE-2026-42018 is an improper authentication flaw (CWE-287) in Artifactory. A request to a specific endpoint returns an internal anonymous-user token to an unauthenticated caller even when anonymous access is administratively disabled. It is rated CVSS 7.5. On its own it exposes an anonymous session; chained with CVE-2026-42016 it becomes the unauthenticated entry point of a full admin takeover. JFrog published fixes on 2026-08-12, and CISA added the CVE to KEV on 2026-09-11.

Affected Versions

Upgrade to the fixed build on your branch or later. JFrog Cloud (SaaS) instances were addressed by JFrog. Because this CVE is chained with CVE-2026-42016, patch both together.

Technical Details

The vulnerable endpoint is /access/api/v1/aws/token/. A trailing slash on the request path causes Spring's AntPathRequestMatcher to fail to match the route, which skips the AwsTokenAuthenticationFilter that should have gated it. With the filter bypassed, an anonymous principal is issued a valid internal JWT even when the administrator has disabled anonymous access.

Attack characteristics:

• Authentication: none required
• Complexity: low
• Vector: network, to the access API
• Impact: exposure of an internal anonymous token, breaking the intended access control (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

In the observed attacks this token is the first link in a chain: the attacker presents it to POST /access/api/v1/tokens and exploits CVE-2026-42016 to exchange it for a full administrator token. Detection is complicated because the resulting admin-scope token retains the "anonymous" username in audit logs.

Discovery

The vulnerability was disclosed through JFrog's security-advisory process on 2026-08-12. The JFrog advisory identifier and the reporting researcher were not surfaced in available reporting. Wiz Research first publicly documented the in-the-wild chaining.

Exploitation Context

Wiz documented the chained campaign between 2026-08-15 and 2026-09-08. The attack flow was: unauthenticated POST to /access/api/v1/aws/token/ to obtain an anonymous JWT (this CVE), then presentation of that token to /access/api/v1/tokens to mint a full administrator token (CVE-2026-42016). Wiz reported roughly 69 percent of organizations vulnerable at disclosure, falling to about 62 percent a month later. The campaign used the same Rust backdoor and Groovy-plugin post-exploitation tooling and the same indicators as CVE-2026-42016: C2 IP 64.207.232.6:8443, payload SHA-1 513a907b69edffc3cb77a494da395178d21ef9bd, and admin account patterns Nxploited_[A-Za-z0-9]{3} and labadmin_<hex>.

Remediation

1. Upgrade Artifactory to the fixed build on your release branch (see table) or later, patching this CVE and CVE-2026-42016 in the same change.
2. Review access logs for POST requests to /access/api/v1/aws/token/, including trailing-slash variants, and for anonymous-identity tokens subsequently used at /access/api/v1/tokens or GET /access/api/v1/users.
3. Hunt for the shared indicators (C2 IP, payload hash, Nxploited_ and labadmin_ accounts) and for Groovy plugins and /dev/shm artifacts.
4. Assume compromise if the instance was exposed and unpatched during 2026-08-15 to 2026-09-08. Rotate all Artifactory tokens and admin credentials, reinspect for persistence after upgrading, and treat any secrets reachable from Artifactory as exposed.
5. Restrict the access API to trusted networks while remediating.