{"id":"CVE-2026-42018","title":"Anonymous user token generation exposure in JFrog Artifactory","summary":"JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-287"],"vendor":"jfrog","product":"artifactory","affected":["artifactory < 7.111.20","artifactory >= 7.117.0 < 7.117.27","artifactory >= 7.125.0 < 7.125.19","artifactory >= 7.133.0 < 7.133.28","artifactory >= 7.146.0 < 7.146.8"],"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-11T00:00:00+00:00"},"exploited":true,"exploitAvailable":true,"published":"2026-08-12","updated":"2026-09-12","sourceUpdated":"2026-09-12T03:55:21.730Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42018","references":[{"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories"},{"url":"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"}],"tags":["cve.org","in-the-wild","exploit-available","kev"],"epss":0.11038,"epssPercentile":0.95772,"kev":true,"kevDateAdded":"2026-09-11","kevDueDate":"2026-09-25","kevRansomware":false,"ingestedAt":"2026-09-14T15:23:07.483Z","exploits":{"nuclei":["CVE-2026-42018"],"checkedAt":"2026-09-21T15:28:52.636Z"},"slug":"CVE-2026-42018","body":"## Overview\n\nJFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.\n\n## Affected\n\n- `artifactory < 7.111.20`\n- `artifactory >= 7.117.0 < 7.117.27`\n- `artifactory >= 7.125.0 < 7.125.19`\n- `artifactory >= 7.133.0 < 7.133.28`\n- `artifactory >= 7.146.0 < 7.146.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":68,"depthScoreParts":{"impact":41.3,"likelihood":2.2,"exploitation":25,"ransomware":0},"changes":[{"seq":207749,"id":"CVE-2026-42018","ts":1789836592462,"field":"epss","old":"0.0092","new":"0.11038"},{"seq":112036,"id":"CVE-2026-42018","ts":1789186653062,"field":"exploit_available","old":"false","new":"true"}]}