NetSPI found chained vulnerabilities in JFrog Artifactory that let an unauthenticated attacker bypass authentication, stash arbitrary artifact metadata, and export restricted artifact bytes to an attacker-chosen filesystem location. The attack chain affected Artifactory OSS and Enterprise, and the identified issues were tracked as CVE-2026-42018 and CVE-2026-69107. #JFrog #Artifactory #CVE-2026-42018 #CVE-2026-69107
Keypoints
- NetSPI discovered a chain of flaws in JFrog Artifactory that allowed retrieval of arbitrary artifacts without authentication.
- CVE-2026-42018 was an authentication bypass caused by a trailing-slash mismatch in
/api/v1/aws/tokenfiltering. - The bypass caused Artifactory to fall back to an anonymous security context and mint a JWT for the anonymous user.
- CVE-2026-69107 enabled unauthorized access to stash search results, letting attacker-controlled repository paths populate session data.
- A second part of CVE-2026-69107 allowed path traversal during export, letting restricted artifact bytes be copied to arbitrary filesystem paths.
- In production, a URL path confusion issue between jf-router and Tomcat helped route requests to the backend web root and retrieve the copied file.
- JFrog remediated CVE-2026-42018 in 7.146.8 and CVE-2026-69107 in multiple fixed releases, including 7.146.8 and several backported versions.
MITRE Techniques
- [T1557 ] Adversary-in-the-Middle – The routing confusion between jf-router and Tomcat let the attacker manipulate request paths to reach backend content (‘jf-router does not normalize the path before matching or proxying’).
- [T1190 ] Exploit Public-Facing Application – The attacker exploited Artifactory endpoints exposed over HTTP to bypass authentication and access protected functionality (‘an unauthenticated attacker to bypass authentication and authorization’).
- [T1078 ] Valid Accounts – The attack minted and used a JWT for the anonymous user, then leveraged that authenticated context to reach protected endpoints (‘effectively returning an authenticated context to the attacker’).
- [T1213 ] Data from Information Repositories – The stash feature was abused to retrieve artifact metadata and later dereference restricted artifact bytes from stored repository data (‘populate the search stash of the session’).
- [T1006 ] Path Traversal – The export flow concatenated attacker-controlled stash names into filesystem paths, enabling directory traversal (‘constructs tmpExportDir at (17)’).
- [T1052 ] Exfiltration to Non-C2 Channel – The copied artifact was written to a Tomcat web directory and then fetched over HTTP without authorization (‘retrieve the copied artifact from the Tomcat web root’).
Indicators of Compromise
- [CVE identifiers ] Vulnerability tracking references – CVE-2026-42018, CVE-2026-69107
- [Endpoint paths ] Exploited and routed API/UI paths – /access/api/v1/aws/token/, /artifactory/ui/stashResults/export, /artifactory/..;/index.html
- [Repository/artifact names ] Example stashed artifact target and source – sample-repo, builds/sample/sample-v1.0.0
- [Session cookies ] Server-side session used to bind stash data – SESSION=Z…m, SESSION=…
- [JWT access tokens ] Bearer token obtained via auth bypass – ey…A
- [Network/service endpoints ] Internal and external routing targets mentioned in exploitation – http://127.0.0.1:8046/router/api/v1/traefik/api/rawdata, http://localhost:8081
- [File paths ] Example traversal and web-root write locations – /opt/jfrog/artifactory/app/artifactory/tomcat/webapps/ROOT/markertag, /tmp