Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
Threat actors exploit CVE-2026-82329, a default-config authentication bypass in JFrog Artifactory, to mint administrator tokens days after patch release.
watchTowr reports that CVE-2026-82329 (CVSS 9.8), an authentication bypass in JFrog Artifactory patched in version 7.161.20 on August 28, 2026, is being actively exploited as of September 1. The flaw, in JFrog Access, lets unauthenticated attackers abuse a 'phantom' join key on default configurations to forge access and mint administrator-level credentials. Observed activity includes admin token generation, user, group, and token enumeration, and backdoor user creation in limited cases, raising supply chain poisoning and lateral movement risks for the widely used artifact repository.
- Patched August 28, 2026 in Artifactory 7.161.20; affects versions across 7.111.4 through 7.161.19
- Default configurations without a configured join key are exploitable without authentication
- Exploitation observed in honeypots from a small set of IPs; no evidence yet of mass scanning
- Attackers minted admin tokens, created backdoor users, and enumerated federated access topologies
- Admin access to Artifactory enables tampering with build pipelines and pushing malicious changes downstream
- CVEs
- CVE-2026-82329
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1136 Create AccountT1528 Steal Application Access Token
- Products
- JFrog Artifactory
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access | 9.8 | 14% | KEVPoC ×2 | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Sep 01, 2026 Vulnerability / Supply Chain Attack Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr . The vulnerability in question is CVE-2026-82329 (CVSS score: 9. 8), a case of authentication bypass that could lead to administrative access in Artifactory.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.