CVE-2026-42016: Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JFrog Artifactory (Self Hosted)to a version that resolves this vulnerability.Fixed in 7.133.11
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42016?
The severity of CVE-2026-42016 is rated high with a score of 8.8.
What vulnerability does CVE-2026-42016 address?
CVE-2026-42016 addresses incorrect authorization validation of user tokens in JFrog Artifactory allowing for privilege escalation.
How do I fix CVE-2026-42016?
To fix CVE-2026-42016, upgrade JFrog Artifactory to version 7.133.11 or later.
What are the affected versions in CVE-2026-42016?
Affected versions for CVE-2026-42016 include all versions of JFrog Artifactory (Self Hosted) before 7.133.11.
What type of attack is possible due to CVE-2026-42016?
CVE-2026-42016 allows for privilege escalation attacks due to improper validation of token scope.