JFrog Artifactory token scope-validation flaw chained with CVE-2026-42018 into admin takeover, confirmed exploited

CVE-2026-42016 + CVE-2026-42018, JFrog Artifactory: chaining two previously-patched token flaws turns an unauthenticated request into full administrative control in two API calls, confirmed exploited since mid-August

JFrog disclosed the two flaws separately and weeks apart, on 2026-07-27 and 2026-08-12, labelling each only "High" without a numeric score (JFrog, 2026-07-27). CVE-2026-42016 (CWE-863 Incorrect Authorization), disclosed 27 July 2026, is a privilege-escalation bug in Artifactory's token handling: the platform validates a token's signature and issuer but not the token's scope (JFrog, 2026-07-27). Wiz describes the consequence: a low-privileged token can be escalated to admin scope (Wiz Research, 2026-09-10). CVE-2026-42018 (CWE-287 Improper Authentication), disclosed 12–13 August 2026, is narrower but supplies the missing first step: Artifactory returns an internal anonymous-user token to a caller who never authenticated, even when anonymous access is disabled (JFrog, 2026-08-13). Neither flaw alone grants administrative control. Wiz Research states that the anonymous token from CVE-2026-42018 and the scope-validation gap in CVE-2026-42016 "together... can turn an unauthenticated request into an admin-scoped token in two steps" (Wiz Research, 2026-09-10).

Kill chain, as Wiz reconstructed it from real intrusions (initial access, T1190). An unauthenticated POST /access/api/v1/aws/token/ (with the trailing slash, since the bare path returns 401) returns HTTP 200 with a JWT scoped to Artifactory's internal anonymous identity, exploiting CVE-2026-42018 (Wiz Research, 2026-09-10). The operator then exchanges that JWT for a new one via POST /access/api/v1/tokens, which returns HTTP 200 carrying admin authority despite the request originating from the anonymous identity, exploiting CVE-2026-42016's missing scope check (T1550.001, forging elevated authority onto an application access token) (Wiz Research, 2026-09-10). The escalated token still shows token:anonymous as its actor in logs, and Wiz treats the internal anonymous identity, or any low-privilege identity, minting tokens, enumerating users or touching plugins as the anomaly to hunt (Wiz Research, 2026-09-10). Wiz observed actors reach a created administrator account in under five minutes from the first request in some cases (Wiz Research, 2026-09-10). CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-09-11 (CISA KEV, catalogue version 2026.09.11).

Post-exploitation observed across the chained cases. Operators create persistent administrator accounts via PUT /api/security/users/<username> or /access/api/ui/users/<username> (T1136.001); deploy malicious Groovy plugins through Artifactory's own extensible plugin framework to gain arbitrary code execution (T1505, abusing a legitimate server extension mechanism for persistence); and run ad-hoc shell commands through the plugin-execution endpoint (GET/POST /api/plugins/execute/<plugin>), used for reconnaissance and file enumeration (T1059) (Wiz Research, 2026-09-10). Across multiple cases Wiz observed a custom Rust-based backdoor with command-and-control capability dropped to disk as a further persistence layer (Wiz Research, 2026-09-10).

Wiz's own patching-velocity data is the second half of the defender-relevant finding: at first disclosure, 67% of organizations running Artifactory had at least one instance vulnerable to CVE-2026-42016, and a similar 69% for CVE-2026-42018; six weeks after CVE-2026-42016's disclosure, 59% remained vulnerable, and CVE-2026-42018 fell only from 69% to 62% over four weeks. The separately disclosed CVE-2026-82329 (an authentication bypass under default configuration, disclosed 28 August 2026) dropped from 67% to 49% within two weeks of its own disclosure (Wiz Research, 2026-09-10). Wiz attributes that faster remediation to CVE-2026-82329's critical severity rating, which likely drove more urgent attention from security teams (Wiz Research, 2026-09-10). The two high-rated flaws in this chain stayed unpatched for longer, and the exploitation Wiz reports began inside that window.

Contradiction: JFrog's CVE-2026-42018 table names 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as the patched builds, while its affected ranges on the last four branches end at those same builds (for example 7.117.0 to 7.117.27) (JFrog, 2026-08-13). Wiz corrected its fixed versions for this CVE on 2026-09-11 and lists 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 (Wiz Research, 2026-09-10). Take the higher build. For CVE-2026-42016 JFrog names 7.133.11 as the only fixed build, so Wiz's 7.111.21, 7.117.28 and 7.125.20 remain inside JFrog's affected range for that flaw (JFrog, 2026-07-27).

Triage: the highest-confidence signal is behavioral rather than a single request: a 401 on the bare token path (/access/api/v1/aws/token without the trailing slash) followed by a 200 on a variant of it, such as the trailing-slash form, from the same client in a short window. That is an operator confirming the vulnerable variant before relying on it, and a normal client does not produce it (Wiz Research, 2026-09-10). Correlate any resulting anonymous-identity token activity against later user-creation, plugin-execution or credential-enumeration calls.

Builds on: JFrog patches a default-configuration authentication bypass that hands an unauthenticated…