CVE-2026-42018: JFrog Artifactory Auth Bypass Chained for Admin Takeover

Overview

CVE-2026-42018 is an improper authentication vulnerability in JFrog Artifactory, the widely deployed binary and package repository manager used across enterprise CI/CD and software supply chain pipelines. The flaw allows Artifactory to return an internal anonymous-user token to an unauthenticated caller even when anonymous access has been explicitly disabled, potentially exposing sensitive resources.

CISA added CVE-2026-42018 to its Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, following confirmation of active in-the-wild exploitation by security firm Wiz Research. The KEV remediation deadline is September 25, 2026.

Technical Details

How It Works

Wiz Research observed attackers chaining CVE-2026-42018 together with CVE-2026-42016 in live attacks between August 15 and September 8, 2026. The exploitation chain worked as follows:

1. The attacker sends a POST request to /access/api/v1/aws/token/ — including a trailing slash — which improperly returns an anonymous JWT token, even on instances with anonymous access disabled.
2. That anonymous token is submitted to /access/api/v1/tokens to generate an administrator-scoped token.
3. Subsequent malicious actions appear in Artifactory's logs as token: anonymous, despite the attacker now holding full administrative authority — significantly complicating detection and forensics.

Post-exploitation activity documented by Wiz included:

• Creating a persistent administrator account (via /api/security/users/) in under five minutes
• Installing malicious Groovy plugins through Artifactory's native plugin framework, enabling arbitrary server-side command execution
• Dropping payloads into writable paths such as /tmp, /dev/shm, and /var/tmp, and establishing command-and-control communications

A related vulnerability, CVE-2026-82329, was also implicated in the same attack wave.

Impact Assessment

Who Is At Risk

Any organization running an internet-exposed JFrog Artifactory instance on an unpatched release branch is at risk of full administrative compromise. Given Artifactory's role as a central artifact/package repository in CI/CD pipelines, a compromised instance is a software supply chain risk, not just a data exposure risk — attackers with admin access can tamper with build artifacts, packages, and Docker images served to downstream consumers.

Patch Status

JFrog shipped fixes for CVE-2026-42018 on the 7.146 branch on April 28, 2026, and on the 7.133 branch on August 12, 2026 — just three days before Wiz observed the attack wave begin. Remediated releases include:

• 7.111.21+
• 7.117.28+
• 7.125.20+
• 7.133.29+
• 7.146.38+
• 7.161.20+

(Version 7.133.11+ separately addresses the related CVE-2026-42016.)

Mitigation

Immediate Actions

• Patch to the fixed release on your branch immediately — see version list above
• Restrict network access to Artifactory management and API endpoints to trusted internal networks
• Review Artifactory logs for suspicious activity, specifically:
  • Requests to /access/api/v1/aws/token/ with a trailing slash
  • Token issuance events attributed to anonymous that subsequently perform administrative actions
  • Newly created administrator accounts you cannot account for
  • Groovy plugin deployment events
• Rotate all Artifactory credentials and tokens if compromise is suspected, and audit for unauthorized admin accounts

Federal Guidance

Per CISA's BOD 26-04, Federal Civilian Executive Branch (FCEB) agencies must apply vendor mitigations by the September 25, 2026 KEV deadline, or discontinue use of the product if mitigations are unavailable.

Background

Artifactory sits at the center of many organizations' build and release pipelines, making it a high-value target: a single authentication bypass chained into admin access gives attackers the ability to poison packages consumed by every downstream build. This active exploitation campaign follows a now-familiar pattern of attackers targeting DevOps and supply-chain infrastructure — treat patching as urgent even outside the federal KEV mandate.

References

• The Hacker News — Attackers Chain JFrog Artifactory Flaws to Gain Admin Control
• Wiz Blog — Artifactory Under Attack: In-the-Wild Exploitation
• CISA Known Exploited Vulnerabilities Catalog