Detect JFrog Artifactory Incorrect Authorization Exploitation (CVE-2026-42016) in Splunk
Detects exploitation of CVE-2026-42016, an incorrect authorization (CWE-863) vulnerability in JFrog Artifactory that allows an authenticated or low-privileged actor to bypass access controls and reach repositories, artifacts, or administrative APIs they are not entitled to. This CVE is on the CISA KEV catalog (BOD 26-04). Detection focuses on anomalous access to protected Artifactory REST API paths (e.g. /artifactory/api/security, /access/api, admin and repository-config endpoints) returning success (2xx) for principals or from sources that should be denied, unusual privilege-relevant actions, and authorization-decision anomalies in access.log / request.log.
MITRE ATT&CK
SPL Detection Query
index=artifactory (sourcetype=jfrog:artifactory:access OR sourcetype=jfrog:artifactory:request)
| rex field=_raw "(?<method>GET|PUT|POST|DELETE)\s+(?<req_path>/[^ ]+)"
| eval status=coalesce(response_code, http_status, status)
| where match(req_path, "^/(artifactory/api/(security|repositories|system)|access/api/v[12]|ui/api/v1/admin)")
| where status>=200 AND status<300
| stats count as hits values(req_path) as paths values(method) as methods min(_time) as first_seen max(_time) as last_seen by src_ip user
| where hits>=3
| sort - hitsSplunk correlation of successful access to Artifactory privileged REST endpoints per source/user, surfacing potential CVE-2026-42016 authorization bypass.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Sanctioned administrator activity against security and repo-config APIs
- Automation/service tokens legitimately granted elevated scopes
- Health-check or inventory tooling touching system endpoints
Other platforms for CVE-2026-42016
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Baseline denied access to Artifactory security endpoint
Expected signal: access.log/request.log entry for /artifactory/api/security/permissions with HTTP 403 for the low-privileged principal.
- Test 2Simulate authorization bypass to security API
Expected signal: access.log entry showing HTTP 200 on /artifactory/api/security/permissions for a principal that previously received 403.
- Test 3Unauthorized repository configuration change
Expected signal: request.log entry: PUT /artifactory/api/repositories/atomic-test-repo returning 200/201 for a non-admin principal.
References (5)
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories
- https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-42016
Response Playbook
Triage
- Identify the principal (user/token) and source IP from the alert, and determine whether that identity is authorized for the accessed security/admin/repository-config endpoint per your Artifactory RBAC model.
- Pull the full access.log/request.log sequence for that principal and source IP around the alert window; look for a permission-denied (403) immediately followed by a success (2xx) on the same protected resource, the hallmark of an authorization bypass.
- Confirm the running Artifactory version and compare against the JFrog security advisory fixed release for CVE-2026-42016 to establish whether the instance is exploitable.
- Enumerate which artifacts, repositories, tokens, or user/permission objects were read, created, modified, or deleted during the suspicious session.
Containment
- Revoke or disable the implicated access token / user session and rotate any credentials or API keys that may have been exposed via the accessed security endpoints.
- Apply the JFrog-provided upgrade for CVE-2026-42016 or, if patching is not immediately possible, restrict administrative/security REST endpoints at the reverse proxy to trusted management networks.
- Temporarily block the offending source IP(s) at the perimeter/WAF and review whether public exposure of the Artifactory admin UI/API is required.
Evidence Collection
- Preserve Artifactory access.log, request.log, and the console/service logs covering the incident window, plus reverse-proxy access logs.
- Export the current permissions, users, tokens, and repository configuration to snapshot state and later detect unauthorized modifications.
- Capture the artifact/repository storage audit trail (checksums, upload/download events) for any resources touched during the session.
Escalation Criteria
- !Escalate to incident response if a 403-then-2xx bypass pattern is confirmed against security/access or admin endpoints, indicating active exploitation.
- !Escalate if unauthorized creation of admin users/tokens, modification of permission targets, or tampering with published artifacts is observed (potential supply-chain compromise).
- !Escalate if the instance is confirmed unpatched and internet-exposed, given KEV/BOD 26-04 remediation timelines.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Artifactory access.log / request.log entries showing 2xx responses on protected endpoints for unauthorized principals - >
Access/security API changes: new tokens, users, or altered permission targets - >
Artifact repository storage audit records (checksum and upload events) - >
Reverse proxy / load balancer access logs fronting Artifactory
Tuning Guidance
Baseline the legitimate administrator and CI/CD service accounts that touch /artifactory/api/security, /access/api, and repository-config endpoints, and allowlist them by principal and source network. Focus alerting on the 403-then-2xx transition and on principals that have never previously accessed privileged endpoints. Raise the per-source hit threshold if administrative automation is noisy, and scope queries to internet-facing Artifactory front ends first.
Hunting Queries
Finds the 403-then-2xx pattern on the same protected Artifactory resource per principal/source — a strong indicator of the CVE-2026-42016 authorization bypass.
CommonSecurityLog | where DeviceProduct has "Artifactory" | extend ReqPath=tostring(RequestURL), Status=toint(column_ifexists("ResponseCode",0)) | where ReqPath has_any ("/artifactory/api/security","/access/api") | summarize StatusSet=make_set(Status) by SourceIP, SourceUserName, ReqPath | where StatusSet has 403 and (StatusSet has 200 or StatusSet has 201)index=artifactory (sourcetype=jfrog:artifactory:access OR sourcetype=jfrog:artifactory:request) ("/artifactory/api/security" OR "/access/api") | eval status=coalesce(response_code,http_status,status) | stats values(status) as statuses by src_ip user req_path | where match(statuses,"403") AND (match(statuses,"200") OR match(statuses,"201"))Atomic Red Team Tests
Establish the expected authorization-denied response for a low-privileged token against a protected endpoint (control/negative case).
Command
curl -sk -o /dev/null -w '%{http_code}\n' -H "Authorization: Bearer $LOWPRIV_TOKEN" https://artifactory.lab.local/artifactory/api/security/permissionsCleanup
unset LOWPRIV_TOKENExpected Telemetry
access.log/request.log entry for /artifactory/api/security/permissions with HTTP 403 for the low-privileged principal.
Expected Detection
No alert (denied); serves as the 403 baseline for the 403-then-2xx hunting query.
In a lab, exercise the CVE-2026-42016 bypass path (or emulate it) so the low-privileged token successfully reads a protected security endpoint.
Command
curl -sk -H "Authorization: Bearer $LOWPRIV_TOKEN" -H "X-JFrog-Art-Api: bypass" https://artifactory.lab.local/artifactory/api/security/permissionsCleanup
echo 'No server-side change from a read; if a permission target was created, delete it via admin API.'Expected Telemetry
access.log entry showing HTTP 200 on /artifactory/api/security/permissions for a principal that previously received 403.
Expected Detection
KQL/SPL privileged-endpoint rule fires; 403-then-2xx hunting query flags the principal/source.
Attempt to create or modify a repository configuration using an under-privileged token to emulate post-bypass abuse.
Command
curl -sk -X PUT -H "Authorization: Bearer $LOWPRIV_TOKEN" -H "Content-Type: application/json" -d '{"key":"atomic-test-repo","rclass":"local","packageType":"generic"}' https://artifactory.lab.local/artifactory/api/repositories/atomic-test-repoCleanup
curl -sk -X DELETE -H "Authorization: Bearer $ADMIN_TOKEN" https://artifactory.lab.local/artifactory/api/repositories/atomic-test-repoExpected Telemetry
request.log entry: PUT /artifactory/api/repositories/atomic-test-repo returning 200/201 for a non-admin principal.
Expected Detection
Privileged-endpoint detection fires on the successful PUT to repositories API by an unauthorized principal.