{"id":"CVE-2026-42016","kind":"vulnerability","aliases":["CVE-2026-42016"],"related":[],"title":"JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a…","description":"JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Artifactory Self-Hosted checks a token's signature and issuer but not its scope, so a low-privileged token can be exchanged for an admin-scoped one (CWE-863). Wiz saw it exploited in the wild from 15 Aug to 8 Sep 2026, chained with CVE-2026-42018 (anonymous token leak). The chain went from an unauthenticated request to an admin token in two steps. Attackers then created admin accounts, dropped Groovy plugins and installed a Rust backdoor. CISA added it to KEV on 11 Sep 2026.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-09-11T00:00:00+00:00","products":[{"name":"JFrog Artifactory (Self-Hosted)","fixed":["7.133.11"],"affected":"< 7.133.11","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.133.11"],"affected":"< 7.133.11","ecosystem":"vendor"},{"name":"JFrog Artifactory","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["artifactory","exploited","jfrog","jfrog-cloud","kev","privilege-escalation","self-hosted","vendor"],"not_affected_if":["jfrog-cloud","managed-hosting","unknown"],"how_to_check":"Check the Artifactory version (UI: Administration > Updates, or GET /artifactory/api/system/version). Any self-hosted version below 7.133.11 is affected. Hunt for compromise: POST /access/api/v1/tokens or POST /access/api/v1/aws/token/ in access logs, requests by 'token:anonymous' that create users (PUT /api/security/users/ or /access/api/ui/users/), unknown admin users, and unexpected .groovy files in $JFROG_HOME/var/etc/artifactory/plugins/.","fix":"Upgrade to 7.133.11 or later. JFrog's advisory lists only '<7.133.11' for this CVE, but the sibling CVE-2026-42018 and the later ones are fixed in later releases per branch (7.146.x, 7.161.x), so move to the latest release on your branch. Upgrading does not evict an attacker. If the instance was exposed, assume compromise: remove unknown admin users and Groovy plugins, and rotate the Access signing/join keys, admin tokens and stored remote-repo, LDAP and DB credentials (Wiz guidance).","status":"open","published_at":"2026-07-27T20:16:39+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:31+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:31:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or patched version JFrog publishes for CVE-2026-42016; the sources do not name a version. Follow CISA BOD 26-04 guidance for the affected asset.","summary":"JFrog Artifactory accepts a token whose signature and issuer are checked but whose scope is not, so a token holder can perform actions beyond what it was granted. An attacker with any valid token can escalate privileges on the Artifactory instance.","category":"vendor","who_cares":["artifactory","self-hosted","jfrog-cloud"],"confidence":0.6,"analyst_note":"Find JFrog's advisory for CVE-2026-42016 to get affected versions, fixed versions, and any token-scope check or config workaround; the KEV entry does not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"severity_if_unknown":"high"},"cost_usd":0.000376,"input_tokens":2204,"output_tokens":312,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find JFrog's advisory for CVE-2026-42016 to get affected versions, fixed versions, and any token-scope check or config workaround; the KEV entry does not give them.","search":"'-04':181C,207C,238C '-2026':17A,20A,94B '-42016':18A,21A '-42018':95B '-863':76B '11':132B '15':85B '2026':90B,134B '26':180C,206C,237C '7.133.11':7A '8':88B 'accord':170C 'account':117B 'action':166C 'add':127B 'adher':234C 'admin':72B,108B,116B 'admin-scop':71B 'anonym':96B 'appli':167C 'applic':204C 'artifactori':2A,31B,45B,136C 'artifactory':23A,28A,30A 'asset':228C 'attack':14A,113B,148C 'aug':86B 'author':140C 'backdoor':125B 'base':185C 'bod':179C,205C,236C 'chain':91B,100B 'check':49B,153C 'cisa':126B,164C,177C,194C 'cloud':36B,210C 'complianc':175C 'contain':137C 'creat':115B 'cve':16A,19A,93B 'cwe':75B 'discontinu':213C 'drop':118B 'due':15A,149C 'ensur':174C,233C 'escal':13A,40B,147C 'evalu':226C 'exchang':68B 'exploit':32B,80B 'exposur':231C 'follow':203C 'forens':196C 'groovi':119B 'guidanc':192C,208C 'guidelin':240C 'host':4A,43B,48B 'hosted':26A 'incorrect':139C 'instal':122B 'instruct':173C 'internet':230C 'issuer':55B 'jfrog':1A,22A,27A,29A,33B,35B,135C 'jfrog-cloud':34B 'kev':37B,130B 'lead':143C 'leak':98B 'low':63B 'low-privileg':62B 'mitig':168C,219C 'note':191C,202C 'one':74B 'patch':239C 'plugin':120B 'priorit':182C 'privileg':12A,39B,64B,146C 'privilege-escal':38B 'product':217C 'request':105B 'requir':165C,198C 'respons':224C 'risk':187C 'rust':124B 'saw':78B 'scope':59B,73B,163C 'secur':183C 'see':188C,199C 'self':3A,25A,42B,47B 'self-host':41B,46B 'self-hosted':24A 'sep':89B,133B 'servic':211C 'signatur':53B 'signature/issuer':157C 'stakehold':222C 'step':112B 'token':51B,65B,97B,109B,156C,161C 'triag':197C 'two':111B 'unauthent':104B 'unavail':221C 'updat':184C 'url':189C,200C 'use':214C 'valid':152C 'vendor':44B,172C 'version':5A 'vulner':9A,141C 'went':101B 'wild':83B 'wiz':77B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-27T20:16:39+00:00","kev":{"dateAdded":"2026-09-11","dueDate":"2026-09-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"reefs@jfrog.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-42016","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42016","severity":null,"published_at":"2026-09-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42016:117","url":null,"severity":null,"published_at":"2026-10-23T21:38:20+00:00","modified_at":"2026-10-23T21:38:20+00:00","first_seen_at":"2026-10-23T21:38:20+00:00","fetched_at":"2026-10-23T21:38:20+00:00","note":"JFrog advisory table (primary) gives <7.133.11 and no workaround. Wiz blog confirms ITW exploitation chain with CVE-2026-42018 and post-exploitation IOCs. Unverified: fixed versions on the 7.146/7.161 branches for this CVE, and whether 7.133.11-7.133.28 is safe against the full chain (the 42018 fix needs 7.133.29 per the Canadian Cyber Centre's list). Social chatter not searched."},{"source":"nvd","external_id":"CVE-2026-42016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42016","severity":null,"published_at":"2026-07-27T20:16:39+00:00","modified_at":"2026-09-12T04:16:32+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1051,"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","title":"JFrog Security Advisories (CVE-2026-66384: <7.146.35; 7.161.0-7.161.16)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1054,"url":"https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201","title":"Wiz: Artifactory Under Attack (in-the-wild exploitation)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}