CVE-2026-42016: JFrog Artifactory Token-Scope Validation Bypass Leading to Admin Takeover

CVE-2026-42016 is a privilege-escalation flaw in JFrog Artifactory Self-Hosted where the server checks a token's signature and issuer but not its scope, letting an attacker who holds any valid low-privileged token exchange it for an administrator-scoped token; it was added to CISA's Known Exploited Vulnerabilities catalog after security researchers documented in-the-wild attacks chaining it with a second Artifactory flaw to install backdoors within minutes.

CVE-2026-42016 affects JFrog Artifactory (Self-Hosted), the binary/artifact repository manager widely used in CI/CD and software-supply-chain pipelines. NVD's description states: "JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token's scope" (NVD).

NVD's own analysis gives this a CVSS v3.1 base score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, requiring only low (not zero) privileges and no user interaction, with high impact to confidentiality, integrity and availability; JFrog's own CNA submission scored it slightly lower at 8.1. The weakness is classified by JFrog as CWE-863 (Incorrect Authorization) (NVD).

JFrog's own security-advisories documentation page returned an access error to this page's automated fetch, so this page relies on NVD, CISA's KEV catalog and independent security research for the vendor-side detail instead of quoting JFrog directly. Cloud security researcher Wiz published a detailed analysis of real-world exploitation, describing how attackers chain CVE-2026-42016 with a second Artifactory flaw, CVE-2026-42018 (an improper-authentication bug that can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled): first calling the anonymous-token endpoint to obtain a low-privileged JWT, then exchanging that token at the tokens API for an administrator-scoped token — "completing this chain in under five minutes" to establish persistent admin accounts. Wiz observed this chain exploited in the wild between 2026-08-15 and 2026-09-08, with attackers deploying custom Rust-based backdoors, creating persistent admin accounts, installing malicious Groovy plugins, and exfiltrating credentials and Artifactory Access signing keys (Wiz: Artifactory Under Attack).

CISA added CVE-2026-42016 to the Known Exploited Vulnerabilities catalog on 2026-09-11, with a required-action due date of 2026-09-25; the catalog records known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.08643 (95.083th percentile), consistent with documented in-the-wild use (FIRST EPSS).

Because this flaw is confirmed exploited in chained attacks that install persistent backdoors, any self-hosted Artifactory instance on a version before 7.133.11 should be upgraded immediately and audited for unexpected admin accounts, unfamiliar Groovy plugins, and signs of credential or signing-key exfiltration.

• Artifactory Self-Hosted before 7.133.11 validates a token's signature/issuer but not its scope, allowing privilege escalation (CWE-863). — NVD
• NVD CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; JFrog's own CNA submission scored it 8.1. — NVD
• Attackers chain CVE-2026-42016 with CVE-2026-42018 (anonymous-token leak) to go from unauthenticated to admin access in under five minutes; exploited in the wild 2026-08-15 to 2026-09-08 to deploy Rust backdoors, create persistent admin accounts, install malicious Groovy plugins, and exfiltrate credentials and signing keys. — Wiz: Artifactory Under Attack
• Added to the CISA KEV catalog on 2026-09-11, due date 2026-09-25; ransomware use listed as Unknown. — CISA KEV
• EPSS score is 0.08643 (95.083th percentile) as of 2026-10-27. — FIRST EPSS