CVE-2026-42016
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
Description
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:LPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:NAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniquesReferences
- ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkitsen·The Hacker News·
- Three JFrog Artifactory Flaws Exploited for Backdoor Deploymenten-us·SecurityWeek· Exploited JFrog Artifactory auth-bypass
- CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEVen·The Hacker News· Exploited JFrog Artifactory privilege-escalation
- Artifactory flaws chained in attacks deploying backdoor malwareen-us·BleepingComputer· Exploited JFrog Artifactory auth-bypass
- Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoorsen·The Hacker News· Exploited JFrog Artifactory rce
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-42016 and every CVE in our database. Create a free account — no credit card required.
Create Free Account