CVE-2026-42016

JFrog Artifactory's incorrect authorization flaw allowed privilege escalation by validating token signatures instead of scopes.

The vulnerability stemmed from a validation error where the system checked token signatures and issuers but ignored token scopes, enabling attackers to escalate privileges. DIB organizations must ensure their artifact repositories enforce strict scope validation to prevent unauthorized access to sensitive build artifacts and credentials. This is a known, unpatched issue now in the KEV catalog, indicating active exploitation in the wild.

Shame score — A fundamental authorization flaw in a widely used supply-chain tool that was actively exploited in the wild, demonstrating severe negligence in securing critical infrastructure.