Listen to this Post
JFrog Artifactory (Self Hosted) before 7.133.11 contains an incorrect authorization flaw tracked as CVE-2026-42016.
The issue is caused by a validation check that verifies the token signature and issuer but not the token’s scope.
Because scope is not enforced, a token that is validly signed and issued can be accepted for actions outside its intended permissions.
This creates a privilege escalation condition in the self-hosted Artifactory deployment.
The weakness is classified as CWE-863: Incorrect Authorization.
JFrog is the source for the CVE record and the affected product mapping.
The affected CPE is cpe:2.3:a:jfrog:artifactory::::::-::.
The vulnerable version range is all versions up to but excluding 7.133.11.
The fixed threshold is version 7.133.11.
The NVD published date is Jul 27, 2026.
The NVD last modified date is Sep 12, 2026.
CISA added the flaw to the Known Exploited Vulnerabilities Catalog.
The KEV vulnerability name is JFrog Artifactory Incorrect Authorization Vulnerability.
CISA added it on September 11, 2026.
The CISA due date is September 25, 2026.
Required action is to apply mitigations in accordance with vendor instructions.
Required action also references CISA BOD 26-04 risk-based security updates.
Required action references CISA Forensics Triage Requirements.
For cloud services, follow BOD 26-04 guidance or discontinue use if mitigations are unavailable.
Stakeholders must evaluate each asset’s internet exposure.
Stakeholders must adhere to BOD 26-04 patching guidelines.
References include JFrog Release Notes.
References include JFrog Vendor Advisory.
References include CISA-ADP US Government Resource.
References include CISA-ADP Third Party Advisory.
The flaw can allow a lower-privileged token to act with broader authorization than intended.
The root cause is trusting token signature and issuer while ignoring the scope claim.
This is an authorization bypass rather than a token forgery issue.
The impact is privilege escalation in JFrog Artifactory Self Hosted before 7.133.11.
Upgrading to 7.133.11 or later removes the affected version range.
DailyCVE Form:
Platform: JFrog Artifactory
Version: before 7.133.11
Vulnerability : Incorrect Authorization
Severity: Not specified
date: Jul 27, 2026
Prediction: Not provided
(end of form)
What Undercode Say:
Analytics:
Check Artifactory version curl -s http://ARTIFACTORY_HOST/artifactory/api/system/version | jq -r '.version'
Search local inventory for affected Artifactory versions grep -R "artifactory" /etc /opt 2>/dev/null | grep -E "7.133.([0-9]|10)"
Decode JWT header and payload without verifying cut -d. -f1-2 token.jwt | base64 -d 2>/dev/null | jq .
Inspect scope claim in JWT payload cut -d. -f2 token.jwt | base64 -d 2>/dev/null | jq '.scope'
Educational check: vulnerable logic validates signature and issuer only def vulnerable_authorize(token, required_scope): verify_signature(token) verify_issuer(token) Missing: verify_scope(token, required_scope) return True
Exploit: (Educational Purposes!)
Educational only: compare required scope against token scope TOKEN_SCOPE=$(cut -d. -f2 token.jwt | base64 -d 2>/dev/null | jq -r '.scope') REQUIRED_SCOPE="admin" [ "$TOKEN_SCOPE" = "$REQUIRED_SCOPE" ] || echo "Scope mismatch but vulnerable code may still authorize"
Educational only: demonstrate missing scope enforcement def authorize_request(token, action_scope): if verify_signature(token) and verify_issuer(token): return True CVE-2026-42016: scope not checked return False
Protection: from this CVE
Upgrade JFrog Artifactory Self Hosted to fixed version Target: >= 7.133.11
Verify version after upgrade curl -s http://ARTIFACTORY_HOST/artifactory/api/system/version | jq -r '.version'
Enforce signature, issuer, and scope validation Reject tokens whose scope does not match the requested action
Impact:
Privilege escalation Incorrect authorization Unauthorized administrative actions CISA KEV exploitation risk Affected versions below 7.133.11
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
