CVE-2026-42016highunder attackCWE-863

CVE-2026-42016: high-severity vulnerability in jfrog artifactory

Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

Published · Updated

Follow this CVE+ Monitor artifactory

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has an official Brazilian government alert.

ssvc Actcvss 8.1epss 8.6%
from disclosure to weapon
Published on NVDJul 27
CISA KEV+46d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-09-25

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

JFrog Artifactory fails to properly check user permissions when validating tokens, allowing attackers to gain higher privileges than they should have. This could let someone access or modify files they shouldn't be able to reach.

Technical detail

The vulnerability stems from improper authorization validation in JFrog Artifactory versions before 7.133.11, where the authentication mechanism validates token signature/issuer but fails to enforce token scope restrictions. An attacker with a valid token can escalate privileges by bypassing scope validation, potentially gaining unauthorized access to protected resources or administrative functions.

Summary generated and translated by AI from the official description.
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
jfrog · artifactory
Related CVEs — jfrog artifactory

In the same product, most dangerous first.

CVE-2026-82329CRITICALPotential authentication bypass leading to administrative access in ArtifactoryEPSS 14.4%KEVCVE-2026-42018HIGHAnonymous user token generation exposure in JFrog ArtifactoryEPSS 10.0%KEVCVE-2026-66384MEDIUMAuthenticated users may write data outside the intended Docker cache pathEPSS 0.7%KEVCVE-2026-65617HIGHPotential remote code execution on an Artifactory package service container.EPSS 0.6%CVE-2026-66014HIGHPotential authentication bypass leading to privilege escalation in ArtifactoryEPSS 0.6%CVE-2026-65921HIGHPotential path traversal leading to unauthorized file writesEPSS 0.6%