Artifactory's access layer trusted an empty join key in a default install

The file that governs this is jfrog-access.bootstrap.json, and operators who never set a non-empty join key in it were exposed without any further misconfiguration ^[6]. The join key is the material the access layer uses to trust cluster members ^[5]. Call the signing-key lookup with the empty value and it returns a predictable 32-byte result; that result signs a join JWT, and the join JWT mints a platform administrator token ^[4]. In a default configuration that path is open to an unauthenticated caller with network access ^[2].

Upgrading closes the signing path but does not invalidate a token that was already minted, and JFrog supports both expiring and non-expiring access tokens, so a forged administrator token can survive the upgrade; the guidance is to review issued tokens and revoke anything unrecognised ^[17]. The write-up does not disclose whether the fixed versions replace an empty join key on an existing install ^[19].

Two further defects JFrog addressed change what an operator can count as a mitigation. CVE-2026-42018 lets an unauthenticated caller obtain an anonymous user token that reaches sensitive artifacts and repository data even when anonymous access is disabled on the instance ^[11]. CVE-2026-42016 is a scope problem: signature and issuer are checked, the token scope is not properly constrained, and a low-privilege token escalates ^[12]. Reported observations describe the two used in sequence, then a plugin installed to execute arbitrary code, persistent accounts created, and configuration and cluster keys exfiltrated ^[13].

James Edwards of Keeper Security said bypassing authentication at the artifact layer is a first-tier supply-chain vulnerability, and that any vulnerable instance reachable over the network should be treated as compromised ^[10]. Collin Hogue-Spears of Black Duck framed it as a zero-trust problem, on the grounds that administrative access to Artifactory reaches the published artifacts downstream systems consume without further review ^[9]. The write-up sets out what admin rights buy: cached packages can be replaced, so a build pulling from the repository compiles tampered dependencies; publishing credentials can be abused; pipelines can be modified to push changes to downstream customers ^[18]. watchTowr's honeypot data was enumeration, and the write-up calls that reconnaissance before lateral movement ^[8].

The fix list covers six maintenance branches ^[20]. The 7.146 branch is affected through 7.146.36 and fixed in 7.146.38; the 7.161 branch is affected through 7.161.19 and fixed in 7.161.20; anything below 7.111.21 goes to 7.111.21 ^[15].