Scanning for CVE-2026-82329 hit 406,000 attempts five days after JFrog disclosed it
One HTTP request to an unauthenticated cluster-join endpoint returns a non-expiring Artifactory admin token, and Fastly logged the volume going from single-digit probes to indiscriminate spraying in five days.
The Watch · Security desk
What happened
- CVE-2026-82329 is a CVSS 9.8 unauthenticated bypass in self-hosted JFrog Artifactory that lets an anonymous caller mint a full platform admin access token with one HTTP request.
- The JFrog Access service splits its trusted cluster join-key configuration on commas without dropping empty entries, and on a default install that value is empty, so an empty key is trusted.
- Origins of the traffic grew from a few IP addresses to nearly 1,400 inside a single day once a proof of concept was public and the tooling was commoditized.
Why it matters
- Who's exposed exposure Registry admin reaches stored credentials, user and repository creation, and published artifacts, so every consumer of those builds is downstream of one unauthenticated request.
- Who has to decide decision Operators who were unpatched on September 1 and 2 have to decide between a patch-and-close ticket and a token hunt, because the minted platform token does not expire on its own.
- What's now possible capability Detection costs a log query: one fixed hash value in the kid field, no behavioural baseline and no vendor telemetry required.
- What it sets up precedent The volume tracked the public exploit rather than the advisory. The practical remediation window for the next deterministic-secret bug is days, not the 30 Microsoft budgets for its own exploited CVEs.
Next story · Build · Sep 30
Attackers chain three JFrog Artifactory flaws to mint their own admin tokensConfirmed2 publishers
The forged JWT is not the prize. Presenting it to `POST /access/api/v1/registry/join` mints a service-scoped admin access token, and that token is then exchanged for a full admin platform token that does not expire [11]. Patching the Access service fixes the bypass, and a token an attacker minted on September 2 stays valid.
The signing secret for the empty join key is a fixed 32-byte value derived from empty input, so the HS256 signature is reproducible by anyone [9]. The forged token's key ID is the SHA-256 of the empty string, e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 [10]. A real cluster peer hits the same method and path but signs with a non-empty join key, so its kid is a different hash [12]. Both get an HTTP 201 back, which is why Fastly points at the pairing: a 201 associated with that empty-string key ID is, in its words, high-confidence evidence of compromise [13].
Add Fastly's three days of counts. Roughly 75,000 attempts on August 31, most of them from offensive security services [15]; just above 171,000 on September 1, the day a public exploit landed [16]; around 406,000 on September 2 [17]. That is about 652,000 attempts in 72 hours [21], with September 2 running some 5.4 times August 31 [22]. These are attempts seen across Fastly's platform, not confirmed compromises [7].
Disclosure did not move the graph. August 28 produced no detected activity, and August 29 and 30 produced single-digit probes [14]. The public exploit set the clock, and the peak came five days after JFrog's advisory [20]. By then the origin count had gone from a handful of IPs to nearly 1,400 inside a day [19], with individual IPs spraying thousands of distinct hosts [18].
What makes the token hunt worth doing is what the registry holds. Artifactory is one of the most widely deployed enterprise binary and package repositories [4], and registry admin means stored credentials, arbitrary user and repository creation, and tampering with published artifacts [5]. Only self-hosted instances are in scope [1]. Fastly has shipped a Next-Gen WAF virtual patch and still tells customers to patch the software [6].
What to watch
- Whether Fastly's threat-actor analysis names organised groups behind the September 1-2 spraying or leaves it as commodity scanning.
- Whether any organisation reports a tampered published artifact or a stolen registry credential traced to CVE-2026-82329.
- Whether attempt volumes after September 2 hold at scanning levels or fall away as reachable unpatched instances are exhausted.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption58
- Hype gap+8
- Incentives62
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-82329 is a critical (CVSS 9.8) unauthenticated authentication bypass in self-hosted JFrog Artifactory that lets an anonymous attacker mint a full platform admin access token with a single HTTP request.
- [2]
The vulnerability was disclosed on August 28, 2026 by JFrog.
- [3]
Fastly's threat research team observed traffic associated with the CVE across its global platform go from initial low-level probing to opportunistic mass scanning.
- [4]
JFrog Artifactory is one of the most widely deployed enterprise binary and package repositories, holding build artifacts for a large share of software producing organizations.
- [5]
An attacker who gains admin control of an artifact registry sits directly in the software supply chain, able to access stored credentials, create users and repositories, and tamper with published artifacts.
- [6]
Fastly Next-Gen WAF has shipped a virtual patch for CVE-2026-82329, and Fastly says it strongly encourages all customers to patch their systems immediately.
- [7]
The figures Fastly reports are counts of exploitation attempts observed across its global platform.
- [8]
The flaw (CWE-287, Improper Authentication) is in the JFrog Access service; when Access builds the set of trusted cluster join keys it splits a configuration string on commas without filtering empty entries, and on a default install that configuration value is empty, so an empty string is inserted as a trusted join key.
- [9]
The empty key's signing secret is fully deterministic, a fixed 32-byte value derived from empty input, so any attacker can forge a valid HS256 join JWT signed with that known secret.
- [10]
The forged token carries a key ID equal to the SHA-256 of the empty string: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.
- [11]
Presenting the forged token to the unauthenticated cluster-join endpoint POST /access/api/v1/registry/join mints a service-scoped admin access token, which is then exchanged for a full admin, non-expiring platform token.
- [12]
A legitimate cluster peer hits the same method and path but signs with a real, non-empty join key, so its kid is a different hash; that single discriminator, the empty-string kid, separates an attack from normal inter-node traffic.
- [13]
The unauthenticated join endpoint returns an HTTP 201 for both legitimate peers and forged tokens, and Fastly states that observing an HTTP 201 response associated with the empty-string key ID is high-confidence evidence of compromise.
- [14]
No exploitation activity was detected on disclosure day, August 28, and volume remained minimal over the subsequent 48 hours, with only single-digit probes across August 29-30.
- [15]
Initial notable activity emerged on August 31 with approximately 75,000 attempts, though offensive security services accounted for most of this volume.
- [16]
Escalation intensified on September 1 following the release of a public exploit, driving attempts just above 171,000.
- [17]
Activity reached its peak on September 2 at around 406,000 attempts, the highest concentration of unique origin countries and attacking IP addresses in the observed timeframe.
- [18]
On September 1 and 2, individual IPs each sprayed across thousands of distinct hosts indiscriminately, scanning rather than performing targeted attacks.
- [19]
Attack origins expanded from a few initial IPs to nearly 1,400 within a single day, spreading once the proof of concept was public and tooling commoditized.
- [20]
The peak of exploitation attempts on September 2 came five days after JFrog's August 28 disclosure.
- [21]
Fastly's counts for August 31 through September 2 total about 652,000 exploitation attempts.
- [22]
The September 2 attempt volume was about 5.4 times the August 31 volume.
Sources
2 independent publishers whose own reporting we read for this story.
- CVE-2026-82329: JFrog Artifactory Authentication Bypass Exploitation Activity | Fastly
fastly.com
1 article · September 17, 2026
- securityweek.comThree JFrog Artifactory Flaws Exploited for Backdoor Deployment - SecurityWeek
1 article · September 17, 2026