Source: cisa.gov
JFrog Artifactory contains an improper authentication vulnerability tracked as CVE-2026-42018. The flaw can cause the system to return an internal anonymous-user token to an unauthenticated caller even when anonymous access is explicitly disabled. This misconfiguration-like behavior could expose sensitive resources and internal API endpoints to unauthorized parties. The vulnerability is listed in CISA's known exploited vulnerabilities catalog and is subject to BOD 26-04 prioritization requirements. Organizations running self-managed Artifactory instances are advised to apply patches detailed in JFrog's security advisories. The issue highlights risks in artifact repository authentication mechanisms. CISA has also outlined forensic triage requirements for affected systems under BOD 26-04 implementation guidance.
