CVE-2026-42016

COMPONENT VERSION RANGE

NewScan fingerprints JFrog Artifactory from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-13. CISA KEV, CVSS 8.1, and Wiz reports in-the-wild exploitation of this and CVE-2026-42018 as a pair. The token check verifies that the signature and issuer are ours and then never asks what the token is ENTITLED to, so a low-privilege token is honoured for actions its scope does not cover - PR:L, C:H/I:H. NVD's range is a single unbounded `versionEndExcluding: 7.133.11` (read live from the API 2026-09-13), and it is recorded here exactly that way, with NO `ge` floor: unlike the SPIP and Budibase rows there is no parallel backport train to hold clear, because JFrog's own advisory names one fix release for the whole product. Version-match only, and not a close call - proving it means presenting a token to a customer's artifact repository and observing that an action it should not authorise succeeds, which is an intrusion, not a scan. VERSION SOURCE is the new JFrog Artifactory tech_signatures row, and it is the reason this id was unwritable until today: the release is published ONLY in the X-JFrog-Version response header on the anonymous /artifactory/api/system/ping. Measured 2026-09-13 on loopback; the container reported 7.161.26, which is above this row's `lt`, so the live build is the PATCHED arm and was watched abstaining. The affected arm is a fixture in tests/integration/tech_version_from_checks.py.