8.8

CVE-2026-42017

Privilege escalation via JFrog Worker event token exposure

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jfrog ≫ Artifactory SwPlatform- Version < 7.133.21
Jfrog ≫ Artifactory SwPlatform- Version >= 7.146.0 < 7.146.8
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.212
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
reefs@jfrog.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://docs.jfrog.com/releases/docs/jfrog-security-advisories
Vendor Advisory
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
Release Notes