# JFrog Artifactory checks a token's signature and issuer but not its scope

Source: https://startwithidentity.com/cves/cve-2026-42016/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

JFrog's advisory, published July 27, 2026, says self-hosted Artifactory versions before 7.133.11 are open to "privilege escalation" because of a "validation check of the token signature/issuer and not the token's scope." A token that Artifactory itself had signed was trusted for any action, whatever permissions it was issued with. The CWE is CWE-863 (incorrect authorization). NVD scores it CVSS 3.1 8.8. JFrog Cloud needs no action.

Wiz reported on September 10, 2026 that attackers chained it with [CVE-2026-42018](https://startwithidentity.com/cves/cve-2026-42018/), which leaked an internal anonymous-user token to unauthenticated callers. The leaked token had a valid signature and issuer, and this flaw let it act as an administrator. Wiz's detection guidance for this step is the anonymous or a low-privilege identity minting tokens at `/access/api/v1/tokens`, enumerating users or calling `/api/plugins`. After access, attackers created admin accounts, installed Groovy plugins and, in one case, read the Access signing key. CISA added it to KEV on September 11, 2026.

## Why it matters

Signature and issuer tell a relying party who minted a token. [Scope](https://startwithidentity.com/glossary/scope/) tells it what the token may do. Checking only the first two treats every token from the right issuer as an all-access pass, so the least-privileged credential in the system is as strong as the most privileged one. Artifactory issues tokens to CI jobs, build agents and integrations, many of them [service accounts](https://startwithidentity.com/glossary/service-account/) with deliberately narrow rights. This bug erased the difference. Any relying party that validates [access tokens](https://startwithidentity.com/glossary/access-token/) should enforce scope or audience on every request, not just at issuance.

## What to do

- Upgrade to 7.133.11 or later, and to the fixed build for CVE-2026-42018 on your branch, since the two were used together.
- Restrict network access to Artifactory and review authentication logs for low-privilege identities performing admin actions.

## After you patch

- Remove admin accounts and plugins you did not create. Wiz notes patching does not revoke a stolen signing key, so reset the Access token certificate on any instance that may have been compromised.
- Re-issue CI and integration tokens after the reset, scoped to the repositories each one needs.

## Sources

- [NVD: CVE-2026-42016](https://nvd.nist.gov/vuln/detail/cve-2026-42016)
- [JFrog security advisories](https://docs.jfrog.com/releases/docs/jfrog-security-advisories)
- [Wiz: Artifactory under attack, in-the-wild exploitation of CVE-2026-42016 and CVE-2026-42018 (September 10, 2026)](https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201)
- [CISA Known Exploited Vulnerabilities catalog, added September 11, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016)