Source: cisa.gov
CVE-2026-42016 is an incorrect authorization vulnerability in JFrog Artifactory that allows attackers to escalate privileges. The flaw arises from improper validation of token signatures and issuers without adequately checking the token's scope. This oversight enables unauthorized actors to gain elevated access within affected Artifactory deployments. The vulnerability is tracked by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. JFrog has published security advisories and self-managed release notes addressing the issue. Organizations running self-managed Artifactory instances are advised to apply the relevant patches immediately. The vulnerability has been assigned a high criticality rating due to its potential for privilege escalation in enterprise environments.
