Token-scope validation flaw in JFrog Artifactory chained with auth bypass for admin takeover (CVE-2026-42016)
Wiz published on 2026-09-10 that this chain is being used against Artifactory servers and VulnCheck added the CVE to its KEV catalog the same day; an unpatched self-hosted instance exposed to the network is at risk of full administrative compromise of the artifact supply chain.
Self-hosted Artifactory validates only an access token's signature and issuer, not its scope, allowing a low-privileged token holder to escalate privileges. Wiz Research reports attackers chaining this with CVE-2026-42018 and the authentication bypass CVE-2026-82329 to gain administrative access to Artifactory instances.
Affected: JFrog Artifactory Self-Hosted < 7.111.20; JFrog Artifactory Self-Hosted >= 7.117.0 < 7.117.27; JFrog Artifactory Self-Hosted >= 7.125.0 < 7.125.19; JFrog Artifactory Self-Hosted >= 7.133.0 < 7.133.28 (original fix 7.133.11); JFrog Artifactory Self-Hosted >= 7.146.0 < 7.146.8
How to Test
Check the running Artifactory version (Administration > System Info or the release shown in the UI footer) against the affected ranges above; any self-hosted build below 7.111.20, 7.117.27, 7.125.19, 7.133.28 or 7.146.8 is vulnerable. Because the observed attacks chain in CVE-2026-82329 (auth bypass), also confirm you are on a build listed as fixed for that CVE (7.161.19, 7.146.36, 7.133.28, 7.125.19, 7.117.27, 7.111.21). Review Artifactory access and request logs for token-based requests performing admin-level actions from unfamiliar sources, audit for newly created admin users or access tokens, and check recently modified or uploaded artifacts in critical repositories.
How to Patch
Upgrade self-hosted Artifactory to a release that closes the whole chain: 7.161.19, 7.146.36, 7.133.28, 7.125.19, 7.117.27 or 7.111.21 (or later on the corresponding line). If the upgrade must wait, restrict network access to the Artifactory instance to trusted sources and rotate existing access tokens after patching.