Advisory · CVE-2026-42016
Artifactory token flaw lets low-priv users become admin
JFrog Artifactory validates token signatures but not token scopes, so an attacker with a low-privileged token can escalate to administrative privileges. Wiz observed in-the-wild chaining into full admin takeover.
- Vendor
- JFrog
- Product
- Artifactory
- Identifier / CWE
- CVE-2026-42016
CWE-863 - Action timing
- Oct 2, 2026
Explain it like I’m five
The club checks that your wristband is genuine but never looks at the color that says which rooms you may enter. Someone with a hallway wristband flashes it confidently and the staff escort them into the vault.
- 01Low-privileged token
The attacker obtains a valid but low-privileged token, for example the internal anonymous-user token exposed by the chained CVE-2026-42018.
- 02Scope ignored
Artifactory validates the token's signature and issuer but does not properly enforce its intended scope.
- 03Admin token minted
A handful of unauthenticated HTTP requests exchange the token for an admin-scoped one, sometimes within minutes.
- 04Persistence planted
Wiz observed attackers creating persistent admin accounts, deploying malicious Groovy plugins, and dropping Rust backdoors.
What happened
On September 11, 2026, CISA added CVE-2026-42016 to the Known Exploited Vulnerabilities catalog. It is an incorrect-authorization flaw in self-hosted JFrog Artifactory, rated high at CVSS 8.8, affecting versions before 7.133.11.
Artifactory validates an access token’s signature and issuer but does not properly enforce the token’s intended scope. An attacker holding a valid low-privileged token can therefore use it to perform unauthorized actions and escalate to administrative privileges. Wiz Research confirmed active, in-the-wild exploitation between August 15 and September 8, 2026, observing multiple actors chain this flaw with CVE-2026-42018, which exposes an internal anonymous-user token to unauthenticated requesters. The two-step sequence (an unauthenticated POST to /access/api/v1/aws/token/ for the anonymous JWT, then an exchange through /access/api/v1/tokens for an admin-scoped token) turns an unauthenticated request into admin control, in some cases moving from first request to a created admin account in under five minutes.
The post-exploitation picture is what makes this a supply-chain incident rather than a simple patch job. Wiz observed persistent administrator accounts with innocuous-looking names, malicious Groovy plugins that execute shell commands and harvest credentials and Access signing keys, and Rust-based backdoors with C2 capability. Wiz’s blunt guidance: if your instance was exposed while vulnerable, assume compromise. Upgrading closes the entry point but does not evict an attacker already inside, and stolen Access signing keys let an attacker mint valid tokens indefinitely without returning to the host.
What to do
- Upgrade self-hosted Artifactory to 7.133.11 or later (per NVD, versions before 7.133.11 are vulnerable).
- Assume compromise for any instance exposed while vulnerable: hunt for the artifacts Wiz describes, including unknown admin accounts (for example names matching Nxploited_, labadmin_, 0xTerror, or svc_*), unexpected Groovy plugins under the plugins directory, and Rust binaries in world-writable paths.
- Reset the Access token signing certificate on any instance where compromise is confirmed or cannot be excluded; patching alone does not revoke tokens an attacker can forge.
- Review access and request logs for the unauthenticated token-exchange request pattern and for enumeration of users, repositories, and tokens.
- Rotate upstream registry credentials, LDAP and mail settings, and any secrets Artifactory stored, since observed plugins specifically harvested them.
- Confirm the fixed version is running and that no unknown admin accounts or plugins remain.
Management note
Artifactory is the vault for your build artifacts and the credentials that feed your pipelines, so an admin takeover here is a supply-chain compromise waiting to happen. The critical lesson from the Wiz research is that this is a patch-plus-hunt incident: upgrading without looking for persistent backdoors leaves the attacker in place with stolen signing keys. Budget the investigation as seriously as the patch.