CVE-2026-42018

CVE-2026-42018 reveals a configuration synchronization failure in JFrog Artifactory where the anonymous-access toggle gates UI and routing but fails to propagate constraints to the internal token service. When administrators disable anonymous access through configuration, the system correctly reflects this state in logs and routing decisions—yet the token-generation mechanism continues issuing tokens as if anonymous access remained enabled. The token remains retrievable through some code path that wasn't audited when the toggle was introduced, creating a divergence between advertised security posture and actual operational state. The CVSS 7.5 with low EPSS should not be read as "moderate severity, hard to exploit." For internal tokens in artifact repositories, the relevant threat model isn't external attackers—it's lateral movement from compromised build systems or CI pipelines that already have network access to Artifactory. The low EPSS likely reflects that this specific token requires particular conditions to weaponize, not that it's inaccessible to relevant adversaries. The supply-chain dimension is the operative concern: Artifactory sits at the heart of software delivery pipelines, so a token enabling unintended access could facilitate artifact substitution or exfiltration of build artifacts containing secrets, credentials, or proprietary code. This appears to be an architectural class rather than an isolated defect. The token service likely predates the anonymous-access flag entirely—code from before the restriction existed that survived not because it was intentionally maintained but because nobody wanted to touch legacy internal services. When the toggle was added, it was grafted onto a routing layer without auditing whether downstream services still issue tokens based on pre-restriction assumptions. Defenders should verify: whether internal token issuance respects the anonymous-access configuration across all code paths; whether other Artifactory security toggles exhibit identical surface-to-core synchronization gaps; and what operations this token actually enables—whether it's limited to metadata enumeration or extends to artifact download and substitution. The fix patches this instance but likely doesn't prevent the next toggle from having the same propagation failure.

Reviewed through automated stages and approved by a human before publication.