Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to CISA’s BOD 26-04 patching guidelines.
KEV: JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
NVD: JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Hunt Artifactory access logs for anomalous API calls from low-privileged tokens accessing admin-only endpoints, indicating token scope bypass via missing scope validation in versions before 7.133.11.
Research details
ComponentToken scope authorization validation
PreconditionsAttacker must have low-privileged valid credentials for Artifactory Self-Hosted and network access to the instance. The target must run a version prior to 7.133.11. No additional configuration or special conditions are required beyond valid user authentication. agent
Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0–8.9) | The vulnerability resides in how Artifactory validates user tokens: it checks the token signature and issuer but does not enforce the token's scope field, allowing a low-privileged user to obtain or craft a token that grants broader access than intended.
SummaryCVE-2026-42016 is a CWE-863 Incorrect Authorization vulnerability in JFrog Artifactory Self-Hosted versions before 7.133.11. The token validation logic verifies the signature and issuer but fails to enforce scope restrictions, enabling a low-privileged authenticated user to escalate to administrative privileges. JFrog released patch 7.133.11 on July 27, 2026. No public proof-of-concept exploit was identified during this research cycle.
Tia coverage
First reported2026-09-01
First exploit report2026-09-11
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.