Privilege Escalation in JFrog Artifactory <7.133.11 (Token Check)
CVE-2026-42016 Published on July 27, 2026
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the tokens scope.
Known Exploited Vulnerability
This JFrog Artifactory Incorrect Authorization Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
The following remediation steps are recommended / required by September 25, 2026: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicab
Vulnerability Analysis
CVE-2026-42016 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-42016 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-42016
Want to know whenever a new CVE is published for JFrog Artifactory? stack.watch will email you.
Affected Versions
jfrog artifactory:- Before 7.133.11 is affected.