Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
Threat actors exploit CVE-2026-82329, a default-config authentication bypass in JFrog Artifactory, to mint administrator tokens days after patch release.
watchTowr reports that CVE-2026-82329 (CVSS 9.8), an authentication bypass in JFrog Artifactory patched in version 7.161.20 on August 28, 2026, is being actively exploited as of September 1. The flaw, in JFrog Access, lets unauthenticated attackers abuse a 'phantom' join key on default configurations to forge access and mint administrator-level credentials. Observed activity includes admin token generation, user, group, and token enumeration, and backdoor user creation in limited cases, raising supply chain poisoning and lateral movement risks for the widely used artifact repository.
- Patched August 28, 2026 in Artifactory 7.161.20; affects versions across 7.111.4 through 7.161.19
- Default configurations without a configured join key are exploitable without authentication
- Exploitation observed in honeypots from a small set of IPs; no evidence yet of mass scanning
- Attackers minted admin tokens, created backdoor users, and enumerated federated access topologies
- Admin access to Artifactory enables tampering with build pipelines and pushing malicious changes downstream
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access JFrog Artifactory contains an improper authentication flaw (CWE-287) that, under the product's default configuration, can let an unauthenticated attacker with network access obtain administrative privileges. The weakness is reachable over the network with no privileges or user interaction required, which is why it carries a critical 9.8 CVSS 3.1 score; an attacker who succeeds effectively gains full administrator control of the artifact repository, and public reporting describes attackers using the flaw to mint admin tokens days after disclosure. Any organization running JFrog Artifactory is in scope — CISA's entry lists the product without version detail, so deployments should verify their versions against JFrog's advisory (AV26-867, Update 1) — with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild: CISA added the CVE to its Known Exploited Vulnerabilities Catalog on 2026-09-02, a public proof-of-concept is available, and news headlines report active exploitation alongside related Artifactory flaws CVE-2026-42016 and CVE-2026-42018. Do: Upgrade Artifactory to a fixed release per JFrog's advisory AV26-867 (Update 1) — the exact affected and fixed versions are not specified in this data, so check the advisory before patching. Until patched, restrict network access to the Artifactory UI and APIs to trusted sources (VPN/firewall allowlists) and review the instance for unauthorized admin tokens or accounts, as in-the-wield attackers have been minting admin tokens. CISA KEV stakeholders must apply mitigations in line with BOD 26-04 within the required timeline or discontinue use of the product. | 9.8 | 8% | KEV PoC ×2 |
| largetens of thousands of deployments, many of them internet-exposed (estimate) |
Full article487 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 01, 2026Vulnerability / Supply Chain Attack
Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr.
The vulnerability in question is CVE-2026-82329 (CVSS score: 9.8), a case of authentication bypass that could lead to administrative access in Artifactory.
"JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges," according to a description of the flaw on CVE.org.
The vulnerability was patched by JFrog with Artifactory version 7.161.20 released on August 28, 2026. It affects the following versions -
- 7.161.0 > 7.161.19
- 7.146.0 > 7.146.36
- 7.133.0 > 7.133.28
- 7.125.0 > 7.125.19
- 7.117.0 > 7.117.27
- 7.111.4 > 7.111.21
"It affects default configs, requires no auth, no user interaction," Vercel CEO Guillermo Rauch said in a post on LinkedIn. "It's an RCE bomb because Artifactory hosts binaries, so you can basically poison everything, but an admin escalation can cause damage even beyond that."
The issue resides in JFrog Access, which is designed to issue and validate credentials. "Instances without an additional join key configured receive a 'phantom' join key that attackers can abuse to forge access and mint administrator-level credentials," Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement shared with The Hacker News.
Ganchev also pointed out that threat actors have begun to weaponize the flaw as of September 1, 2026, to generate admin tokens and enumerate users, groups, credential sets and federated access topologies.
"This moved from disclosure to real-world exploitation with uncomfortable efficiency," Ganchev added. "Anyone following along knows what comes next: things will get worse."
"When attackers gain admin level access to a central software supply chain system, they can do what every engineering team does best – build, ship and distribute software fast. From there, they could tamper with build pipelines, move laterally into production systems and potentially push malicious changes downstream to customers."
Ganchev said exploitation efforts targeting watchtower's honeypots have originated from a small number of IP addresses from varying geographies, although there is no evidence of broad-scale scanning or mass exploitation at this stage.
"Some observed activity showed evidence of CVE verification only, where the vulnerability was successfully exploited and then stopped. Other attempts successfully exploited the vulnerability and then probed or enumerated the JFrog Artifactory instances to determine whether the environment was worth further exploitation," Ganchev added.
"In limited cases, threat actors created backdoor users and enumerated existing Artifactory users, their groups, tokens, and the system's federated access topologies."
Organizations that are running self-managed versions of JFrog Artifactory are recommended to apply patches to internet-exposed systems with immediate effect, as well as inspect audit logs, rotate exposed credentials, and review connected systems for malicious changes or backdoor access.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html