PoC published for privilege escalation in JFrog Artifactory

A working proof of concept is now public for CVE-2026-42016, a privilege escalation flaw in self-hosted JFrog Artifactory. The exploit code sits in a GitHub repository that also references a second bug, CVE-2026-42018, and a bug tracking account flagged the release on X.[1]github.comgithub.com · rssOpen original sourceSee in source list[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

According to the advisory summary, Artifactory releases before 7.133.11 verify a security token's signature and issuer but never check its scope, the field that says what the token is allowed to do. That gap is what the exploit rides.[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list[3]dbu.gsdbu.gs · rssOpen original sourceSee in source list

The public record starts with a paired drop. A tracker entry went up on dbu.gs under the ID PT-2026-65102, a GitHub user named dylvie published a repository for CVE-2026-42016 and CVE-2026-42018, and the ptdbugs account posted a summary on X. All three carry the same timestamp, so disclosure and exploit code arrived together.[3]dbu.gsdbu.gs · rssOpen original sourceSee in source list[1]github.comgithub.com · rssOpen original sourceSee in source list[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

The post lays out the mechanics as reported: self-hosted Artifactory versions before 7.133.11 are open to privilege escalation because the product validates a token's signature and issuer but not its scope.[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list[3]dbu.gsdbu.gs · rssOpen original sourceSee in source list

Artifactory is where many organizations keep the packages and containers their software is built from. If a low-privilege user can climb to admin inside it, they could in principle redirect builds toward tampered artifacts, which makes this the kind of bug development teams should treat as urgent rather than routine.[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

Public exploit code also lowers the effort bar. What previously demanded original vulnerability research is now a download away, which compresses the window between disclosure and attempted abuse.[1]github.comgithub.com · rssOpen original sourceSee in source list

If you run Artifactory yourself, check your current version against 7.133.11, the release the advisory names as the boundary. Anything older falls inside the reported vulnerable range, so schedule the upgrade now rather than after the weekend.[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list[3]dbu.gsdbu.gs · rssOpen original sourceSee in source list

Cloud-hosted customers appear to have less to worry about in this specific report, since the advisory text names the self-hosted product as the affected deployment.[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

Settled so far: exploit code is public, the affected product is self-hosted JFrog Artifactory, and the reported version cutoff is 7.133.11.[1]github.comgithub.com · rssOpen original sourceSee in source list[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

Still open: nothing in this batch shows active exploitation in the wild, no CVSS score or full vendor advisory text is available beyond the tracker summary, and there is no detail on how CVE-2026-42018, named only in the repository title, relates to the escalation bug.[1]github.comgithub.com · rssOpen original sourceSee in source list[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

ptdbugs, the account behind the notice, put it plainly on X: versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature and issuer and not the token's scope. The account also linked the dbu.gs entry for readers who want the primary record.[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list[3]dbu.gsdbu.gs · rssOpen original sourceSee in source list

The story has a single beat so far. The tracker entry, the exploit repository, and the social post all share one timestamp, so the timeline begins with disclosure and weaponization landing at the same moment rather than a slow build from rumor to code. Whether JFrog responds with its own advisory is the next marker to watch.[1]github.comgithub.com · rssOpen original sourceSee in source list[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list

2 independent groups, 1 updates, and 0 engagements.

The failure mode, as described, is a missing authorization check on an already authenticated token. Artifactory confirms the token was genuinely issued, by checking signature and issuer, but skips the scope check that would confirm what the token is permitted to do, so a token minted for limited access can be pushed into acting with broader rights. Note this description comes from the tracker summary, not from JFrog's own advisory.[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list[3]dbu.gsdbu.gs · rssOpen original sourceSee in source list

This item rests on three artifacts: the dbu.gs advisory page for PT-2026-65102, the dylvie GitHub repository carrying proof of concept code for CVE-2026-42016 and CVE-2026-42018, and the ptdbugs post on X that carried the summary text. The two web sources arrived as catalogue entries without body text, so the technical wording in this report traces back to the post.[3]dbu.gsdbu.gs · rssOpen original sourceSee in source list[1]github.comgithub.com · rssOpen original sourceSee in source list[2]ptdbugsx.com · ptdbugs · xOpen original sourceSee in source list