JFrog Artifactory

CVE-2026-42016 is a privilege-escalation flaw in JFrog Artifactory Self Hosted versions prior to 7.133.11. When Artifactory validates an access token (JWT), it correctly verifies the cryptographic signature and the issuer claim but fails to validate the token's scope claim — the field that defines what the bearer is actually allowed to do. An authenticated user with any valid low-privilege token can exchange it at the /access/api/v1/tokens endpoint for a new token carrying admin scope, granting full control over the Artifactory instance: user management, repository configuration, plugin deployment, and cluster-key extraction. In the wild, this bug is chained with CVE-2026-42018 (which leaks an anonymous-user JWT to an unauthenticated caller), collapsing the entire path from zero access to full admin in two HTTP requests.

JFrog rated this HIGH at 8.1 — that score is dangerously low for the real-world situation. Artifactory is, by definition, a supply-chain artifact store: every CI/CD pipeline pulling packages through it trusts its integrity. Admin takeover means an attacker can inject poisoned artifacts into every downstream build. CISA agrees — they added it to the KEV catalog on September 2, 2026 with a September 25 remediation deadline. Wiz Research documented active exploitation from August 15 through September 8 with Rust-based backdoors, persistent admin accounts, and malicious Groovy plugins dropped post-compromise. Fastly logged 406,000 exploitation attempts on September 2 alone. The vendor's 8.1 dramatically underweights the blast radius of owning a package registry.

Why this verdict

• Active exploitation removes all theoretical friction. This is not a hypothetical chain — Wiz documented multiple actors exploiting it from Aug 15 through Sep 8, 2026, with Fastly logging 406K attempts in a single day. CISA KEV-listed it on September 2.
• PR:L prerequisite is nullified in practice. CVE-2026-42018, which is present in overlapping version ranges, hands an anonymous JWT to any unauthenticated caller. The real-world chain is unauth → admin in two HTTP requests, not the PR:L the CVSS vector suggests.
• Role multiplier: Artifactory IS the supply chain. Unlike a bug in a component that *might* be deployed in a high-value role, Artifactory's sole purpose is serving as a software artifact repository. 100% of installs occupy the 'CI/CD + artifact store' high-value role. Admin takeover → artifact poisoning → every downstream build is compromised. Blast radius is supply-chain-scale by definition.
• Trivial exploit complexity. The attack is two POST requests with no memory corruption, no race conditions, no special tooling. Public PoC has been available since September 1. The bar for exploitation is script-kiddie level.
• Remediation stall amplifies risk. Six weeks post-disclosure, 59% of Artifactory instances remain vulnerable per Wiz telemetry. The patch gap is widening the exploitation window.

Why not higher?

A 9.6 is already near the ceiling. The only factor preventing a 10.0 is that the Availability impact is None (the CVSS vector shows A:N) — the attacker gains read/write control but the vulnerability itself does not directly cause denial of service. Additionally, JFrog Cloud customers are unaffected, meaning a portion of the Artifactory user base is inherently protected.

Why not lower?

Downgrading below CRITICAL is impossible here. The affected component is canonically a supply-chain artifact store (100% of installs serve this role), the chain ends in full admin takeover enabling supply-chain poisoning, it is actively exploited in the wild with a trivial two-request chain, and CISA has KEV-listed it. Every floor condition is met: high-value role ≥10% of install base, blast radius at supply-chain scale, active exploitation. Even if we considered the PR:L in isolation, the companion CVE-2026-42018 eliminates it in overlapping version ranges. There is no friction factor that could pull this below the CRITICAL floor.

1. Block /access/api/v1/ paths from untrusted networks immediately — The entire attack chain flows through Artifactory's Access API. Deploy WAF or reverse-proxy rules to restrict /access/api/v1/tokens, /access/api/v1/aws/token/, and /access/api/v1/registry/join to trusted management IPs only. This is your fastest mitigation — deploy within the 3-day noisgate mitigation SLA for CRITICAL.
2. Audit all Artifactory admin accounts NOW — Search for the known IoC account patterns: svc_[a-zA-Z0-9]{8}, Nxploited_*, labadmin_*, 0xTerror, jfrog-distribution, repo-service, backup-service, ldap_admin. Any admin account created after August 15 that was not provisioned through your IAM workflow should be treated as compromise evidence. Do this today.
3. Rotate all Artifactory tokens and the cluster join key — If you were vulnerable at any point during the Aug 15 – Sep 8 exploitation window, assume tokens may have been minted by attackers. Rotate all access tokens, revoke any you cannot account for, and regenerate the cluster join key (/access/api/v1/system/security/join_key). Do this within 3 days.
4. Disable the Groovy plugin framework if not in use — Post-exploitation relies on Groovy plugins for code execution. If your deployment does not use custom plugins, disable the framework entirely to eliminate this lateral-movement path. This reduces blast radius even if the initial escalation succeeds.
5. Deploy network egress controls on Artifactory hosts — Block outbound connections from Artifactory servers except to explicitly allowed destinations. This prevents C2 callback to attacker infrastructure (observed: 64.207.232[.]6:8443, log.gitclone[.]org:45678). Essential for limiting post-exploitation impact.
6. Verify artifact integrity across all repositories — If compromise is suspected, audit artifact checksums against known-good baselines or upstream source checksums. Any artifact modified outside your CI/CD workflow during the exploitation window should be treated as potentially poisoned. Prioritize container images and internal library packages.

Run this script on the Artifactory host or any machine with curl and network access to your Artifactory instance. Invoke as: bash check_cve_2026_42016.sh https://your-artifactory.example.com:8082. No authentication required — it checks the version endpoint which is typically unauthenticated.

#!/usr/bin/env bash
# check_cve_2026_42016.sh — Detect CVE-2026-42016 (JFrog Artifactory token scope escalation)
# Usage: bash check_cve_2026_42016.sh <ARTIFACTORY_BASE_URL>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <ARTIFACTORY_BASE_URL>"
  echo "Example: $0 https://artifactory.corp.example.com:8082"
  exit 2
fi

BASE_URL="${1%/}"

# Attempt to get version from system info endpoint
VERSION=$(curl -sf --connect-timeout 10 "${BASE_URL}/api/system/version" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[0-9.]+' || true)

if [ -z "$VERSION" ]; then
  # Try alternative endpoint
  VERSION=$(curl -sf --connect-timeout 10 "${BASE_URL}/api/system" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[0-9.]+' || true)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not retrieve Artifactory version from ${BASE_URL}"
  echo "Ensure the URL is correct and the version endpoint is accessible."
  exit 2
fi

echo "Detected Artifactory version: ${VERSION}"

# Parse version components
IFS='.' read -ra PARTS <<< "$VERSION"
MAJOR=${PARTS[0]:-0}
MINOR=${PARTS[1]:-0}
PATCH=${PARTS[2]:-0}

# CVE-2026-42016 is fixed in 7.133.11
# All versions prior to 7.133.11 are vulnerable
if [ "$MAJOR" -lt 7 ]; then
  echo "VULNERABLE — Version ${VERSION} is below the 7.133.11 fix for CVE-2026-42016."
  exit 1
elif [ "$MAJOR" -eq 7 ]; then
  if [ "$MINOR" -lt 133 ]; then
    echo "VULNERABLE — Version ${VERSION} is below 7.133.11. Token scope validation is missing."
    exit 1
  elif [ "$MINOR" -eq 133 ] && [ "$PATCH" -lt 11 ]; then
    echo "VULNERABLE — Version ${VERSION} is below 7.133.11. Token scope validation is missing."
    exit 1
  elif [ "$MINOR" -eq 133 ] && [ "$PATCH" -ge 11 ]; then
    echo "PATCHED — Version ${VERSION} includes the CVE-2026-42016 fix."
    echo "NOTE: Also verify patches for CVE-2026-42018 and CVE-2026-82329 which affect different version branches."
    exit 0
  else
    # Versions on higher minor branches (7.146, 7.161, etc)
    # These branches have separate fix versions for the companion CVEs
    echo "PATCHED — Version ${VERSION} is on a branch above 7.133 (CVE-2026-42016 fix baseline)."
    echo "WARNING: Verify CVE-2026-42018 and CVE-2026-82329 patches for your specific branch."
    exit 0
  fi
else
  echo "PATCHED — Version ${VERSION} is above the affected major version."
  exit 0
fi

Sources

1. Wiz Research — Artifactory Under Attack: In-the-Wild Exploitation
2. The Hacker News — Attackers Chain JFrog Artifactory Flaws
3. The Register — More JFrog Artifactory bugs under attack
4. CybersecurityNews — JFrog Artifactory Vulnerabilities Actively Exploited
5. GBHackers — Hackers Exploit JFrog Artifactory Flaws
6. OpenCVE — CVE-2026-42016 Details
7. CISA Known Exploited Vulnerabilities Catalog
8. SecurityOnline — JFrog Artifactory Vulnerabilities Exploited in the Wild