CVE-2026-42017 - Privilege escalation via JFrog Worker event token exposure

HIGH

Privilege escalation via JFrog Worker event token exposure

Published Jul 27, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.52%

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
0	affected	<7.133.21
7.146.0	affected	<7.146.8

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

Link	Providers	Tags
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases		vendor-advisoryRelease Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisories		vendor-advisoryVendor Advisory