Hackers Exploit JFrog Artifactory Flaws to Bypass Authentication and Gain Admin Access
AI summary · glm-5.3-flashSummaries by Vani AI
Wiz Research observes multiple attackers exploiting three JFrog Artifactory flaws, including default-configuration authentication bypass CVE-2026-82329, to gain admin access and deploy backdoors.
Attackers chain CVE-2026-42018 and CVE-2026-42016 to exchange anonymous JWTs for administrator-scoped tokens, or exploit CVE-2026-82329 directly via the registry join endpoint to obtain admin privileges under default configuration. Post-exploitation observed by Wiz includes persistent admin users created within five minutes, malicious Groovy plugins for command execution, and Rust-based backdoors dropped to /tmp, /var/tmp, and /dev/shm with C2 communications. Compromise exposes software artifacts, repository credentials, CI/CD integrations, and cluster secrets, creating supply chain risks. Fixed releases include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20.
Key facts
- Chaining CVE-2026-42018 and CVE-2026-42016 lets unauthenticated attackers escalate anonymous tokens to administrator scope.
- CVE-2026-82329 grants admin privileges under default configuration via POST /access/api/v1/registry/join.
- Observed post-exploitation includes persistent accounts, malicious Groovy plugins, and Rust backdoors in writable directories.
- Attackers extracted cluster join keys, minted tokens, and enumerated users and repositories across incidents.
- Fixed versions include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1136 Create AccountT1059 Command and Scripting Interpreter
- Products
- JFrog Artifactory
- Organizations
- Wiz Research
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42016 | Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory | 8.8 | 9% | KEV | KEV |
| CVE-2026-42018 | Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens | 7.5 | 10% | KEV | KEV |
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access | 9.8 | 14% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gitclone.org | xploiting CVE-2026-82329 2026-09-02 Not provided hxxp://log.gitclone[.]org:45678/smtp Payload download URL following CVE-2026-42018/ |
| ipv4 | 103.124.165.42 | 16 Actor IP exploiting CVE-2026-82329 2026-09-03 2026-09-03 103.124.165[.]42 Actor IP exploiting CVE-2026-82329 2026-09-03 2026-09-03 |
| ipv4 | 104.28.251.139 | 13 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 104.28.251[.]139 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 |
| ipv4 | 105.188.75.16 | 90 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 105.188.75[.]16 Actor IP exploiting CVE-2026-82329 2026-09-03 2026-09-03 |
| ipv4 | 129.121.56.234 | 10 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 129.121.56[.]234 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 |
| ipv4 | 137.184.111.69 | 39 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 137.184.111[.]69 Actor IP exploiting CVE-2026-82329 2026-09-02 Not provide |
| ipv4 | 146.19.216.120 | 69 Actor IP exploiting CVE-2026-42018 2026-09-04 2026-09-04 146.19.216[.]120 Actor IP exploiting CVE-2026-82329 2026-09-01 2026-09-01 |
| ipv4 | 149.102.229.150 | loiting CVE-2026-42018/CVE-2026-42016 2026-08-28 2026-09-07 149.102.229[.]150 Actor IP exploiting CVE-2026-42018/CVE-2026-42016 2026-08 |
| ipv4 | 15.157.64.113 | 92 Actor IP exploiting CVE-2026-82329 2026-09-06 2026-09-07 15.157.64[.]113 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 |
| ipv4 | 155.254.120.23 | 52 Actor IP exploiting CVE-2026-82329 2026-09-03 2026-09-03 155.254.120[.]23 Actor IP exploiting CVE-2026-82329 2026-09-02 2026-09-02 |
| ipv4 | 16.54.250.190 | 34 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 16.54.250[.]190 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 |
| ipv4 | 176.88.121.152 | 42 Actor IP exploiting CVE-2026-82329 2026-09-03 2026-09-03 176.88.121[.]152 Actor IP exploiting CVE-2026-82329 2026-09-03 2026-09-03 |
| ipv4 | 182.62.201.69 | 40 Actor IP exploiting CVE-2026-42018 2026-09-02 2026-09-02 182.62.201[.]69 Actor IP exploiting CVE-2026-42018 2026-09-04 2026-09-04 |
| ipv4 | 185.190.58.172 | 20 Actor IP exploiting CVE-2026-82329 2026-09-01 2026-09-01 185.190.58[.]172 Actor IP exploiting CVE-2026-82329 2026-09-03 2026-09-03 |
| ipv4 | 186.247.79.240 | loiting CVE-2026-42018/CVE-2026-42016 2026-08-30 2026-08-30 186.247.79[.]240 Actor IP exploiting CVE-2026-42018 2026-09-02 2026-09-02 |
| ipv4 | 220.246.124.92 | 23 Actor IP exploiting CVE-2026-82329 2026-09-02 2026-09-02 220.246.124[.]92 Actor IP exploiting CVE-2026-82329 2026-09-06 2026-09-07 |
| ipv4 | 223.144.227.110 | 88 Actor IP exploiting CVE-2026-82329 2026-09-02 2026-09-04 223.144.227[.]110 Actor IP exploiting CVE-2026-82329 2026-09-04 2026-09-04 |
| ipv4 | 3.88.162.79 | 18/CVE-2026-42016 exploitation 2026-09-06 2026-09-08 hxxp://3.88.162[.]79:36789/smtp Second-stage payload download URL 2026-09-07 2 |
| ipv4 | 45.61.176.88 | 72 Actor IP exploiting CVE-2026-82329 2026-09-03 2026-09-03 45.61.176[.]88 Actor IP exploiting CVE-2026-82329 2026-09-02 2026-09-04 |
| ipv4 | 64.207.232.6 | 21ef9bd SHA-1 hash of /tmp/.z payload 2026-09-06 2026-09-08 64.207.232[.]6:8443 Command-and-control address 2026-09-08 2026-09-08 sv |
| ipv4 | 93.104.155.133 | 11 and later Ioc Indicator Description First seen Last seen 93.104.155[.]133 Actor IP exploiting CVE-2026-42018/CVE-2026-42016 2026-08 |
| sha1 | 513a907b69edffc3cb77a494da395178d21ef9bd | mtp Second-stage payload download URL 2026-09-07 2026-09-08 513a907b69edffc3cb77a494da395178d21ef9bd SHA-1 hash of /tmp/.z payload 2026-09-06 2026-09-08 64.207. |
| url | http://3.88.162.79:36789/smtp | 026-42018/CVE-2026-42016 exploitation 2026-09-06 2026-09-08 hxxp://3.88.162[.]79:36789/smtp Second-stage payload download URL 2026-09-07 2026-09-08 5 |
| url | http://log.gitclone.org:45678/smtp | Actor IP exploiting CVE-2026-82329 2026-09-02 Not provided hxxp://log.gitclone[.]org:45678/smtp Payload download URL following CVE-2026-42018/CVE-2026-42 |
From the original article
3 min read at gbhackers.com
Threat actors are actively exploiting three vulnerabilities in JFrog Artifactory, CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, to bypass authentication, escalate privileges, and gain administrative control of exposed instances.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.