CVE-2026-42018
JFrog Artifactory returns an internal anonymous-user token to an unauthenticated caller even when anonymous access is DISABLED (CISA KEV, exploited in the wild)
- Severity
- high
- Affected product
- JFrog Artifactory
- Affected versions
- JFrog Artifactory < 7.111.20
- Affected versions
- JFrog Artifactory ≥ 7.117.0, < 7.117.27
- Affected versions
- JFrog Artifactory ≥ 7.125.0, < 7.125.19
- Affected versions
- JFrog Artifactory ≥ 7.133.0, < 7.133.28
- Affected versions
- JFrog Artifactory ≥ 7.146.0, < 7.146.8
- Fixed in
- JFrog Artifactory 7.111.20
- Fixed in
- JFrog Artifactory 7.117.27
- Fixed in
- JFrog Artifactory 7.125.19
- Fixed in
- JFrog Artifactory 7.133.28
- Fixed in
- JFrog Artifactory 7.146.8
- Detection basis
- Component version range
- Shipped rule
- JFrog Artifactory: JFrog Artifactory returns an internal anonymous-user token to an unauthenticated caller even when anonymous access is DISABLED (CISA KEV, exploited in the wild)
- Added to NewScan
- 2026-09-14
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints JFrog Artifactory from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints JFrog Artifactory from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints JFrog Artifactory from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints JFrog Artifactory from its response and reports this CVE when the detected version falls inside the affected range below.
COMPONENT VERSION RANGE
NewScan fingerprints JFrog Artifactory from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.