CVE-2026-42018: JFrog Artifactory could return an internal anonymous-user
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
- CISA KEV-listed (remediation due 2026-09-25)
- EPSS 9.8% (95.5% percentile)
- CVSS 7.5 high