Overview
CVE-2026-42018 is an improper authentication vulnerability in JFrog Artifactory, the widely deployed binary and package repository manager used across enterprise CI/CD and software supply chain pipelines. The flaw allows Artifactory to return an internal anonymous-user token to an unauthenticated caller even when anonymous access has been explicitly disabled, potentially exposing sensitive resources.
CISA added CVE-2026-42018 to its Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, following confirmation of active in-the-wild exploitation by security firm Wiz Research. The KEV remediation deadline is September 25, 2026.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-42018 |
| Severity | High (CVSS 7.5) |
| Attack Vector | Network |
| Authentication | None Required |
| Impact | Authentication bypass → administrative takeover |
| CISA KEV | Yes — remediation due September 25, 2026 |
How It Works
Wiz Research observed attackers chaining CVE-2026-42018 together with CVE-2026-42016 in live attacks between August 15 and September 8, 2026. The exploitation chain worked as follows:
- The attacker sends a
POSTrequest to/access/api/v1/aws/token/— including a trailing slash — which improperly returns an anonymous JWT token, even on instances with anonymous access disabled. - That anonymous token is submitted to
/access/api/v1/tokensto generate an administrator-scoped token. - Subsequent malicious actions appear in Artifactory's logs as
token: anonymous, despite the attacker now holding full administrative authority — significantly complicating detection and forensics.
Post-exploitation activity documented by Wiz included:
- Creating a persistent administrator account (via
/api/security/users/) in under five minutes - Installing malicious Groovy plugins through Artifactory's native plugin framework, enabling arbitrary server-side command execution
- Dropping payloads into writable paths such as
/tmp,/dev/shm, and/var/tmp, and establishing command-and-control communications
A related vulnerability, CVE-2026-82329, was also implicated in the same attack wave.
Impact Assessment
Who Is At Risk
Any organization running an internet-exposed JFrog Artifactory instance on an unpatched release branch is at risk of full administrative compromise. Given Artifactory's role as a central artifact/package repository in CI/CD pipelines, a compromised instance is a software supply chain risk, not just a data exposure risk — attackers with admin access can tamper with build artifacts, packages, and Docker images served to downstream consumers.
Patch Status
JFrog shipped fixes for CVE-2026-42018 on the 7.146 branch on April 28, 2026, and on the 7.133 branch on August 12, 2026 — just three days before Wiz observed the attack wave begin. Remediated releases include:
- 7.111.21+
- 7.117.28+
- 7.125.20+
- 7.133.29+
- 7.146.38+
- 7.161.20+
(Version 7.133.11+ separately addresses the related CVE-2026-42016.)
Mitigation
Immediate Actions
- Patch to the fixed release on your branch immediately — see version list above
- Restrict network access to Artifactory management and API endpoints to trusted internal networks
- Review Artifactory logs for suspicious activity, specifically:
- Requests to
/access/api/v1/aws/token/with a trailing slash - Token issuance events attributed to
anonymousthat subsequently perform administrative actions - Newly created administrator accounts you cannot account for
- Groovy plugin deployment events
- Requests to
- Rotate all Artifactory credentials and tokens if compromise is suspected, and audit for unauthorized admin accounts
Federal Guidance
Per CISA's BOD 26-04, Federal Civilian Executive Branch (FCEB) agencies must apply vendor mitigations by the September 25, 2026 KEV deadline, or discontinue use of the product if mitigations are unavailable.
Background
Artifactory sits at the center of many organizations' build and release pipelines, making it a high-value target: a single authentication bypass chained into admin access gives attackers the ability to poison packages consumed by every downstream build. This active exploitation campaign follows a now-familiar pattern of attackers targeting DevOps and supply-chain infrastructure — treat patching as urgent even outside the federal KEV mandate.