CVE-2026-42018

JFrog Artifactory leaked anonymous-user tokens to unauthenticated callers when anonymous access was disabled, exposing sensitive resources.

An improper authentication flaw in JFrog Artifactory returned internal anonymous-user tokens to unauthenticated callers even when anonymous access was disabled, allowing unauthorized access to sensitive resources. DIB organizations must ensure Artifactory is patched and configured to prevent token leakage, as this directly violates access control requirements under NIST 800-171. The vulnerability was actively exploited in the wild, indicating a high risk of data exposure and compliance failure.

Shame score — The vendor shipped a product with a known authentication flaw that was actively exploited in the wild, demonstrating negligence in patching and secure design.