CVE-2026-42018

Description

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

CVSS Vector

References

• https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
• https://docs.jfrog.com/releases/docs/jfrog-security-advisories