JFrog Artifactory CVE-2026-42018

The vulnerability is exploitable when anonymous access is administratively disabled - paradoxically, this is the configuration where the flaw manifests. No credentials, special headers, or non-default configuration on the attacker's side are required. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against network-accessible Artifactory instances with no user interaction. The primary limiting factor is network reachability: Artifactory instances not exposed to untrusted networks (e.g., behind a VPN with no external access) are not directly exploitable from the internet, though they remain vulnerable to insider threats or compromised internal hosts. No special protocol, feature enablement, or specific Artifactory edition has been identified as a prerequisite beyond the product being deployed and reachable.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the real-world risk profile: network-reachable, zero prerequisites, full confidentiality impact, no integrity or availability dimension. EPSS data was not provided, so exploitation probability cannot be quantified, but the attack complexity is objectively low - any HTTP client can trigger the flaw. No KEV listing is present, meaning confirmed active exploitation has not been recorded by CISA at time of analysis. Artifactory is common in enterprise software supply chains, meaning the blast radius of a successful token disclosure extends beyond the repository itself to any system trusting those artifacts. Even a relatively small IT organization - comparable in scale to a mid-sized municipal infrastructure team operating in a city like tczew - should treat this as urgent given the combination of network exposure and high confidentiality impact. The absence of an integrity or availability vector is a partial mitigating factor, but read-only access to a private artifact repository can expose source code, credentials embedded in artifacts, and internal build tooling.

An unauthenticated attacker sends a standard HTTP request to the Artifactory API endpoint that returns authentication tokens. Despite anonymous access being disabled by the administrator, the server responds with a valid internal anonymous-user token. The attacker then uses this token to authenticate subsequent requests and browse or download artifacts from repositories that should require credentials. No public exploit code has been identified at time of analysis.