JFrog Artifactory Vulnerabilities Let Unauthenticated Attackers Steal Private Artifacts
Summary
NetSPI detailed two Artifactory vulnerabilities that could be chained to let unauthenticated attackers retrieve restricted artifacts. JFrog fixed them in specified releases.
Key points
- CVE-2026-42018 lets an unauthenticated attacker obtain a JWT for Artifactory's anonymous user through an authentication-filter bypass.
- CVE-2026-69107 combines missing authorization checks and path traversal in stash search-result export to expose restricted artifact contents.
- The reported chain can enumerate repository and artifact paths, copy an artifact to a web-accessible location, and retrieve it without authorization.
- NetSPI reported the issues to JFrog in April 2026; the article says all Artifactory OSS and Enterprise versions were affected at discovery.
- CVE-2026-42018 was fixed in Artifactory 7.146.8. CVE-2026-69107 was fixed in 7.146.8, 7.133.21, 7.125.14, 7.117.21, 7.111.14, and 7.104.16.
Article Details
- Vulnerability Types
- Authentication bypass
- Missing authorization checks
- Path traversal
- URL path confusion
- Affected Versions
- All versions of Artifactory OSS and Artifactory Enterprise were affected at the time of discovery
- Artifactory OSS 7.133.16 was used in the lab demonstration
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available