CVE-2026-42018

No fix known ExploitedEPSS 10%CVSS 7.5

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Published 2026-08-12 · In CISA KEV since 2026-09-11 · CVE record · OSV

Products: Jfrog Artifactory