Attackers chain three JFrog Artifactory flaws to mint their own admin tokens
Attackers are chaining three self-hosted JFrog Artifactory flaws, one rated CVSS 9.8, to mint administrator tokens in under five minutes. Because every build resolves its packages through that one repository, it is as efficient to attack as to run.
The Engineer · Build desk
What happened
- CVE-2026-82329, rated critical, lets an unauthenticated attacker obtain administrative control on its own, without touching the other two flaws.
- The chain's first link, CVE-2026-42018, hands an anonymous user token to an unauthenticated caller even on instances where anonymous access has been disabled.
- After gaining admin, intruders created persistent administrator accounts, deployed malicious Groovy plugins to run code, harvested Access signing keys, and left anti-forensics measures behind.
- Fixes shipped between late July and late August, exploitation was seen from mid-August, and instances that had not upgraded stayed exposed for weeks.
Why it matters
- Who's exposed exposure An attacker holding the repository can swap cached packages and abuse stored publishing credentials, so the compromise reaches builds that never touched the vulnerable server.
- Who has to decide decision Every token issued before the upgrade has to be treated as compromised and rotated, and administrator accounts and their attached SSH keys audited for unfamiliar entries.
- What it limits constraint Suspect plugins and accounts should be disabled and preserved, not deleted, because attribution and scope assessment depend on artifacts a cleanup destroys.
- What doesn't add up contradiction The two write-ups name different fixed builds for the 7.133 branch, 7.133.11 and 7.133.29, so confirm the branch-to-version mapping against JFrog's advisory before upgrading.
Next story · Security · Sep 17
Scanning for CVE-2026-82329 hit 406,000 attempts five days after JFrog disclosed itConfirmed2 publishers
The chain of the two lesser flaws is a few HTTP calls. An unauthenticated POST to /access/api/v1/aws/token/ with a trailing slash returns HTTP 200 and a JWT for the internal anonymous user, CVE-2026-42018 [17]. That token is exchanged at POST /access/api/v1/tokens for one carrying admin authority, using the scope-validation weakness CVE-2026-42016 [17][4]. The escalated token keeps the anonymous username, so the administrative requests that follow appear in the logs with an actor of token:anonymous [18]. Audit only for unfamiliar usernames and you will miss it.
CVE-2026-82329 works differently. In a default JFrog Access install the trusted set includes an empty-string join key, which leaves the signing key for that entry fully known, so an attacker can forge a cluster join token and mint a platform administrator token [1]. watchTowr reported attackers minting administrator tokens for themselves and then enumerating users, groups, credential sets and federation topology [2].
Wiz.io, which disclosed the flaws, said: "These CVEs are trivial to exploit, a handful of unauthenticated HTTP requests. If your instance was exposed while vulnerable, assume compromise and hunt for post-exploitation artifacts. Upgrading closes the door but does not evict an attacker who is already inside" [7][15].
Erik York, a cybersecurity specialist, wrote on LinkedIn: "Artifactory sits at the center of a LOT of software supply chains. This is exactly the kind of bug that turns into next year's SolarWinds story if it's not patched fast" [21]. Jim Nitterauer, senior director of information security at Graylog, said: "Because Artifactory sits at the heart of software build pipelines, a compromise is a direct supply-chain risk and patch adoption has lagged badly, with attacks observed within four days of disclosure of the third bug" [9].
A fix only helps the instances that install it, so the durable controls are the ones that do not depend on upgrade timing: immutable artifacts, signed releases verified at deploy time, separation between the repository management plane and the build network, and least-privilege tokens that cannot be escalated [14].
What to watch
- Whether CISA adds the three CVEs to its Known Exploited Vulnerabilities catalog and sets a federal patch deadline.
- Any confirmed downstream tampering traced to a compromised instance, such as replaced cached packages or abused publishing credentials.
- Whether JFrog or Wiz publishes fuller indicators of compromise beyond the token:anonymous log actor and malicious Groovy plugins.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-82329 (CVSS 9.8) is an improper authentication flaw; in a default JFrog Artifactory install the JFrog Access trusted set includes an empty-string join key, so the signing key for that entry is fully known, letting an attacker forge a cluster join token and mint a platform administrator token.
- [2]
watchTowr reported attackers minting administrator tokens for themselves and enumerating users, groups, credential sets and federation topology.
- [3]
CVE-2026-42018 (CVSS 7.5) is an improper authentication issue that lets an unauthenticated caller obtain an anonymous user token granting access to sensitive artifacts and repository data, and it worked even where anonymous access had been disabled.
- [4]
CVE-2026-42016 (CVSS 8.1) is an incorrect authorization flaw: the token signature and issuer are validated but the token scope is not properly restricted, so a low-privilege token can be used to escalate.
- [5]
Once an attacker controls the artifact repository, cached packages can be replaced and publishing credentials abused, and the affected systems include every build that pulls from it.
- [6]
Fixes were published between late July and late August 2026, in-the-wild exploitation was observed from mid-August, and instances that had not been upgraded were exposed for weeks after a fix was available.
- [7]
Wiz.io disclosed the three vulnerabilities and reports that attackers are chaining them to achieve privilege escalation and full administrator control of self-hosted Artifactory instances.
- [8]
After gaining administrative access, attackers were observed creating persistent administrator accounts, deploying malicious Groovy plugins for code execution, harvesting credentials and Access signing keys, establishing backdoors, and deploying anti-forensics mechanisms.
- [9]
Because Artifactory sits at the heart of software build pipelines, a compromise is a direct supply-chain risk and patch adoption has lagged badly, with attacks observed within four days of disclosure of the third bug.
- [10]
CVE-2026-82329 is rated critical severity and allows an unauthenticated attacker to obtain administrative control, while CVE-2026-42018 and CVE-2026-42016 are rated high severity.
- [11]
Artifactory sits at a chokepoint by design: it is the single place where dependencies and images are resolved, which makes it efficient to operate and efficient to attack.
- [12]
Recommended remediation includes rotating tokens and treating any token issued before remediation as compromised, and auditing administrator accounts and attached SSH keys for unfamiliar entries.
- [13]
A suspicious administrator account or plugin file should be disabled and preserved rather than deleted, because attribution and scope assessment depend on artifacts a hasty cleanup destroys.
- [14]
Controls that do not depend on upgrade timing reduce what one authentication bypass yields: immutable artifacts, signed releases verified at deploy time, separation between the repository management plane and the build network, and least-privilege tokens that cannot be escalated.
- [15]
These CVEs are trivial to exploit, a handful of unauthenticated HTTP requests. If your instance was exposed while vulnerable, assume compromise and hunt for post-exploitation artifacts. Upgrading closes the door but does not evict an attacker who is already inside.
- [16]
In some observed cases attackers completed the exploitation and established administrative access in under five minutes.
- [17]
An unauthenticated POST /access/api/v1/aws/token/ with a trailing slash returned HTTP 200 with a JWT for the internal anonymous user (CVE-2026-42018), which was exchanged at POST /access/api/v1/tokens for an admin-scoped token via the CVE-2026-42016 scope-validation flaw.
- [18]
The escalated token kept the anonymous username but carried admin authority, so later requests appear in the logs with an actor of token:anonymous.
- [19]
JFrog's advisory identifies 7.133.11 and later as the fixed version, and 7.161.20 as the fixed release for the CVE-2026-82329 branch.
- [20]
Self-hosted Artifactory environments should be patched to any fixing version, including 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 or newer depending on the deployed release branch.
- [21]
Artifactory sits at the center of a LOT of software supply chains. This is exactly the kind of bug that turns into next year's SolarWinds story if it's not patched fast.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toWhen the Artifact Repository Is the Target: JFrog Artifactory and the Software Supply Chain Chokepoint
1 article · September 30, 2026
- infoq.comArtifactory Vulnerabilities Under Active Exploitation Enable Authentication Bypass and Admin Access
1 article · September 28, 2026
Topics and entities
Topics
- Software Supply Chain Security
- Artifact repositories and package proxies
- Authentication Bypass Flaws
- Actively Exploited Vulnerabilities and KEV Mandates