JFrog Product Security Update Advisory

Overview.

Security updates have been released to address vulnerabilities in JFrog products.
Users of these products should update to the latest version.

Affected Products and Versions.

• CVE-2026-42016: Artifactory versions earlier than 7.133.11.
• CVE-2026-42018: Artifactory versions earlier than 7.111.20.
• CVE-2026-42018: Artifactory versions 7.117.0 Through 7.117.27.
• CVE-2026-42018: Artifactory versions 7.125.0 Through 7.125.19.
• CVE-2026-42018: Artifactory versions 7.133.0 Or higher but less than 7.133.28.
• CVE-2026-42018: Artifactory versions 7.146.0 Or higher but less than 7.146.8.

Resolved Vulnerabilities.

• CVE-2026-42016 is a privilege escalation vulnerability in JFrog Artifactory (Self-Hosted) caused by a failure to validate the scope of user tokens.
• CVE-2026-42018 is a vulnerability in JFrog Artifactory where internal anonymous user tokens are exposed to unauthenticated users even when anonymous access is disabled.

Patch Information.

Vulnerability Patches are available in the latest updates.
Follow the instructions on the reference site to update to the following versions.

• CVE-2026-42016: Artifactory 7.133.11.
• CVE-2026-42018: Artifactory 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8.