Detect JFrog Artifactory Improper Authentication (CVE-2026-42018) in CrowdStrike LogScale
Detects exploitation attempts against CVE-2026-42018, an improper authentication (CWE-287) vulnerability in JFrog Artifactory that allows attackers to bypass authentication controls and access protected repository resources, administrative endpoints, or artifacts without valid credentials. This CVE is listed in the CISA KEV catalog, indicating active in-the-wild exploitation. The detection surfaces anomalous authentication bypass patterns including access to privileged Artifactory REST API endpoints (/api/security, /api/system, admin repository operations) without corresponding successful authentication events, requests bearing forged or malformed authorization headers, and unauthenticated retrieval of protected artifacts.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=HttpRequest
| (UrlPath=/*\/api\/security.*/ OR UrlPath=/*\/api\/system.*/ OR UrlPath=/*\/access\/api\/v1\/tokens.*/ OR UrlPath=/*\/api\/repositories.*/)
| in(field="HttpStatusCode", values=["200", "201", "204"])
| case { AuthorizationHeader="*" | AuthPresent:=1 ; * | AuthPresent:=0 }
| UserName="" OR UserName="anonymous" OR UserName="-" OR AuthPresent=0
| groupBy([RemoteAddress, UrlPath], function=count(as=hits))
| hits >= 3
| sort(hits, order=desc)Surfaces successful unauthenticated or anonymous requests to sensitive Artifactory endpoints captured in HTTP request telemetry.
Data Sources
Required Tables
False Positives & Tuning
- Public repository anonymous pulls.
- Health-check traffic.
- Telemetry lacking populated UserName/AuthorizationHeader fields.
Other platforms for CVE-2026-42018
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated access to Artifactory security API
Expected signal: Reverse-proxy/IIS and Artifactory access logs record a GET to /api/security/permissions from the test host with no authorization header.
- Test 2Anonymous token minting attempt against Access API
Expected signal: Access log records a POST to /access/api/v1/tokens; Access service logs a token-creation event.
- Test 3Anonymous repository enumeration
Expected signal: IIS/reverse-proxy logs record a GET to /api/repositories with an anonymous or empty user field.
References (5)
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories
- https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-42018
Response Playbook
Triage
- Confirm the running Artifactory version against JFrog's security advisory for CVE-2026-42018 and determine if the instance is a patched or vulnerable release.
- Review the source IPs flagged by the detection: geolocate them, check reputation, and determine whether they are internal CI/CD runners, known scanners, or external unknown hosts.
- Correlate the flagged requests with the Artifactory access.log (request_response.log) to confirm the requests returned protected data without a valid principal.
- Determine which sensitive endpoints were accessed (/api/security for permissions/tokens, /api/system for config, /api/repositories for repo enumeration) to scope potential data exposure.
Containment
- Restrict inbound access to the Artifactory UI/API to trusted networks via firewall/reverse-proxy ACLs until patching is complete.
- Disable or restrict anonymous access globally and revoke any access tokens or API keys that may have been exposed or created via the bypass (/access/api/v1/tokens).
- If exploitation is confirmed, isolate the Artifactory node from the network and fail over to a known-good replica if available.
Evidence Collection
- Preserve Artifactory access.log, request.log, and console.log covering the exploitation window, plus the reverse-proxy/IIS/NGINX access logs.
- Snapshot the Artifactory database and configuration to capture any attacker-created users, tokens, permission targets, or repositories.
- Export the full HTTP transactions (headers and bodies where captured) for the flagged source IPs for forensic and IOC extraction.
Escalation Criteria
- !Escalate to incident response if protected artifacts, credentials, or admin configuration were successfully retrieved without authentication.
- !Escalate if attacker-created accounts, access tokens, or modified permission targets are discovered.
- !Escalate if the bypass was used to publish or overwrite artifacts, indicating a potential supply-chain compromise of downstream consumers.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Artifactory access.log / request_response.log entries showing 2xx responses to protected endpoints with empty or anonymous principals. - >
Reverse-proxy (NGINX/IIS) access logs recording the raw request lines and source IPs. - >
Newly created access tokens in the Access service database and new permission targets or admin users in the security configuration.
Tuning Guidance
Baseline the set of source IPs that legitimately perform anonymous reads against public repositories (CI runners, package managers) and exclude them via an allowlist. Ensure the reverse proxy is not stripping the Authorization header before logging, which would otherwise cause authenticated requests to appear unauthenticated and inflate false positives. Tighten the hit threshold upward in high-traffic environments and focus on write/admin methods (POST/PUT/DELETE) against /api/security and /access endpoints for the highest-fidelity alerts.
Hunting Queries
Hunts for token-creation requests against the Access API that succeeded, which may indicate an attacker minting credentials after bypassing authentication.
W3CIISLog | where csUriStem contains "/access/api/v1/tokens" and csMethod == "POST" and scStatus startswith "20" | project TimeGenerated, cIP, csUserName, csUriStem, scStatusindex=web (uri_path="*/access/api/v1/tokens*") method=POST status>=200 status<300 | stats count by src_ip, user, uri_pathAtomic Red Team Tests
Attempts to retrieve the Artifactory permissions/security configuration without providing any credentials to validate whether the endpoint is reachable anonymously.
Command
curl -s -o /dev/null -w '%{http_code}\n' http://artifactory.lab.local:8081/artifactory/api/security/permissionsCleanup
echo 'No cleanup required; read-only request.'Expected Telemetry
Reverse-proxy/IIS and Artifactory access logs record a GET to /api/security/permissions from the test host with no authorization header.
Expected Detection
KQL/SPL rules flag a successful (2xx) unauthenticated request to a sensitive /api/security endpoint.
Attempts to create an access token via the Access API without authentication to simulate credential creation after an auth bypass.
Command
curl -s -X POST http://artifactory.lab.local:8081/access/api/v1/tokens -d 'scope=applied-permissions/admin' -w '\nHTTP:%{http_code}\n'Cleanup
curl -s -X DELETE http://artifactory.lab.local:8081/access/api/v1/tokens/revoke -d 'token=<created_token>' || trueExpected Telemetry
Access log records a POST to /access/api/v1/tokens; Access service logs a token-creation event.
Expected Detection
Hunting query for token-creation POSTs and the primary rule flag the unauthenticated POST to the tokens endpoint.
Enumerates configured repositories through the REST API without credentials to test authentication controls on repository metadata.
Command
powershell -c "try { $r = Invoke-WebRequest -Uri 'http://artifactory.lab.local:8081/artifactory/api/repositories' -UseBasicParsing; $r.StatusCode } catch { $_.Exception.Response.StatusCode.value__ }"Cleanup
Write-Host 'No cleanup required; read-only request.'Expected Telemetry
IIS/reverse-proxy logs record a GET to /api/repositories with an anonymous or empty user field.
Expected Detection
Detection rules flag successful anonymous access to /api/repositories and aggregate repeated hits from the source.