CVE-2026-65616: JFrog Artifactory Auth Bypass Vulnerability

CVE-2026-65616 Overview

CVE-2026-65616 is an authorization bypass vulnerability in JFrog Artifactory. The flaw resides in the refresh token signature validation logic. Incorrect authorization checks let a non-admin authenticated user obtain a signed JFrog administrator token. Once issued, the token grants full administrative privileges over the Artifactory instance, including repository management, user administration, and access to stored artifacts. The weakness is tracked under CWE-347: Improper Verification of Cryptographic Signature. Attackers can leverage the flaw remotely across a network with low privileges and no user interaction, making it well-suited for lateral movement in software supply chain environments.

Critical Impact
A low-privileged authenticated user can escalate to JFrog administrator by exploiting flawed refresh token signature validation, gaining full control over Artifactory-hosted repositories and artifacts.

Affected Products

JFrog Artifactory (self-managed distributions)
CPE: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*
Component identifier: jfrog:artifactory

Discovery Timeline

2026-07-27 - CVE-2026-65616 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-65616

Vulnerability Analysis

The vulnerability affects the refresh token workflow in JFrog Artifactory. Artifactory issues signed tokens that encode identity and authorization claims. When a client requests a refreshed access token, the server must validate that the requester is authorized to receive a token with the claimed scope. In vulnerable builds, this authorization step is incomplete. An authenticated non-admin user can submit a refresh request and receive back a signed token containing administrator scope.

The returned token carries a valid cryptographic signature produced by the Artifactory signing key. Downstream components that trust the signature will accept the token as an authentic administrator credential. This gives the attacker persistent administrative access that survives session termination until the token expires or is revoked.

Root Cause

The root cause is improper verification tied to token issuance rather than a broken signature primitive. The server correctly signs tokens but fails to enforce that the caller's existing privileges match the scope embedded in the newly issued token. Signature validation logic accepts the resulting token because the cryptographic signature itself is well-formed. This pattern maps to CWE-347 because trust decisions are made on signature presence without validating the caller's authorization to produce that signed payload.

Attack Vector

Exploitation is network-based and requires an authenticated account on the target Artifactory instance. The attacker calls the token refresh endpoint with a crafted request that claims administrator scope. The server returns a signed administrator token. The attacker then uses that token against the Artifactory REST API to create users, modify repository permissions, or extract stored packages. Refer to the JFrog Security Advisories Documentation for the vendor's technical description.

No public proof-of-concept code has been released. This article describes the vulnerability class in prose only.

Detection Methods for CVE-2026-65616

Indicators of Compromise

Unexpected issuance of tokens with scope=jfrt@*:admin or equivalent admin claims to accounts that were not previously administrators.
Access log entries showing calls to /api/security/token or /access/api/v1/tokens followed by administrator-only API activity from the same source.
New admin users, permission targets, or repository configurations created by accounts with no prior administrative history.
Artifact downloads or deletions from restricted repositories initiated by accounts that lacked prior access.

Detection Strategies

Correlate token issuance events with the requesting user's baseline privilege level; alert when issued scope exceeds caller privilege.
Alert on any privilege change in Artifactory (admin=true flag set on a user) that is not tied to an approved change ticket.
Review Access service audit logs for refresh token calls that return payloads containing admin scope to non-admin subjects.

Monitoring Recommendations

Forward Artifactory access.log, request.log, and Access service audit logs to a centralized SIEM for continuous review.
Track authentication anomalies such as token reuse from unexpected IP ranges or user agents.
Baseline normal administrative API call volumes and alert on deviations.

How to Mitigate CVE-2026-65616

Immediate Actions Required

Upgrade JFrog Artifactory to a fixed release as listed in the JFrog Artifactory Release Notes.
Revoke all active refresh tokens and force reissuance after patching to invalidate any tokens minted during the exposure window.
Audit the administrator group and remove any accounts that were not explicitly authorized.
Rotate signing keys used by the Access service if compromise is suspected.

Patch Information

JFrog has published fixed Artifactory versions through its release channel. Consult the JFrog Security Advisories Documentation for the specific version ranges affected and the corresponding patched builds. Apply the vendor-recommended upgrade path for both single-node and high-availability deployments.

Workarounds

Restrict network access to the Artifactory token endpoints so only trusted management networks can call them.
Enforce short token expiration windows to reduce the useful lifetime of any illegitimately issued administrator token.
Require multi-factor authentication on all Artifactory accounts to raise the cost of the prerequisite authenticated foothold.
Disable local account creation and integrate authentication with a managed identity provider that enforces least privilege.

bash

# Configuration example: revoke and reissue tokens after patching
# Revoke a specific token via the Access API
curl -u admin:<password> -X DELETE \
  "https://artifactory.example.com/access/api/v1/tokens/<token_id>"

# List active tokens for review
curl -u admin:<password> -X GET \
  "https://artifactory.example.com/access/api/v1/tokens"