JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Researchers have observed exploitation of multiple JFrog Artifactory flaws as recently as September 8. Apply the available patches ASAP.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.111.20, 7.117.x prior to 7.117.27, 7.125.x prior to 7.125.19, 7.133.x prior to 7.133.28, or 7.146.x prior to 7.146.35. It is, therefore, affected by an improper authentication vulnerability. JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Self-hosted JFrog Artifactory versions prior to 7.111.21, 7.117.x prior to 7.117.28, 7.125.x prior to 7.125.20, 7.133.x prior to 7.133.29, 7.146.x prior to 7.146.38 and 7.161.x prior to 7.161.20 suffer from an improper authentication vulnerability. The AWS assumed role token exchange endpoint of the JFrog Access service fails to enforce authentication when the request path carries a trailing slash. A remote and unauthenticated attacker can therefore submit a POST request to that endpoint and be granted a valid access token bound to the internal anonymous user, even when anonymous access is disabled on the instance. The disclosed token authenticates against the platform APIs and can be used to enumerate repositories and read the hosted artifacts and the server metadata exposed to that identity. This issue has been observed being chained with CVE-2026-42016 to escalate the disclosed token to an administrator scoped credential.

ID	Name	Product	Family	Type	Severity
345894	JFrog Artifactory < 7.111.20 / 7.117.x < 7.117.27 / 7.125.x < 7.125.19 / 7.133.x < 7.133.28 / 7.146.x < 7.146.35 Improper Authentication	Nessus	Misc.	Local	high
115474	JFrog Artifactory Anonymous User Token Disclosure	Web App Scanning	Component Vulnerability	Check Based	high

Detections

Analytics

CVE-2026-42018

high

Tenable Plugins

high

high