EUVD-2026-57388
GHSA-3q94-gprh-7pwm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable with no prerequisites; token disclosure yields high confidentiality loss but no write or availability impact.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
4DescriptionCVE.org
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Articles & Coverage 1
AnalysisAI
JFrog Artifactory exposes an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Any network-reachable attacker can obtain this token and use it to access resources that should be protected behind authentication controls. No public exploit has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a straightforward information-disclosure path against misconfigured or unpatched Artifactory instances.
Technical ContextAI
JFrog Artifactory is an artifact repository manager widely used in enterprise CI/CD pipelines. The vulnerability is rooted in CWE-287 (Improper Authentication): the server-side logic that governs anonymous access fails to suppress token issuance when anonymous access is administratively disabled. Rather than returning an authentication error, the endpoint returns an internal bearer token scoped to the anonymous user. This token may then be used to authenticate subsequent API calls, bypassing the intended access control gate. The CPE string cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:* covers all Artifactory editions and versions, indicating the flaw is not version-range-limited in the available intelligence.
RemediationAI
The primary fix is to apply the patched Artifactory release referenced in the JFrog self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases - however, an exact fixed version number was not provided in the available intelligence and should be verified directly from the JFrog advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories before patching. Patch available per vendor advisory. As a compensating control prior to patching, restrict network access to Artifactory's API endpoints at the perimeter or load balancer layer so that only authenticated internal clients can reach the service; note this does not eliminate the flaw but reduces the exposure surface. Audit Artifactory access logs for unexpected anonymous-scoped API calls that may indicate prior exploitation. Do not rely on the 'anonymous access disabled' configuration setting alone as a control, as this CVE demonstrates that setting is insufficiently enforced.
More in Artifactory
View allAuthentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full admi
Privilege escalation in JFrog Artifactory Self-Hosted before 7.133.11 lets a low-privileged authenticated user leverage
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
An issue was discovered in JFrog Artifactory 6.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute a
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif
JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that
Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository
Information disclosure in JFrog Artifactory allows authenticated users with read access to an ordinary repository to ret
JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted ser
Privilege escalation in JFrog Artifactory stems from an authentication handling weakness in how the platform processes i
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts lo
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today