2026-09-01 · view entry permalink →
CVE-2026-82329, JFrog Artifactory: an unauthenticated attacker gets administrative access under default configuration (CVSS 9.8)
JFrog disclosed CVE-2026-82329 on 2026-08-28: an authentication weakness in Artifactory, its widely deployed CI/CD binary and artifact repository, that under default configuration lets an unauthenticated attacker with only network access obtain full administrative privileges (GitHub Advisory Database, 2026-08-28). CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the flaw carries CWE-287, Improper Authentication. JFrog has not published the specific request path or authentication defect being bypassed, so defenders cannot yet reason about a concrete exploitation signature beyond the precondition: a self-hosted, network-reachable instance still on its default configuration (IONIX Threat Center, 2026-08-31).
Self-hosted branches 7.111.4 through 7.111.20, 7.117.0 through 7.117.27, 7.125.0 through 7.125.19, 7.133.0 through 7.133.28, 7.146.0 through 7.146.36 and 7.161.0 through 7.161.19 are affected; fixes shipped the same day in 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 respectively, per each fixed release's own "CVEs Addressed" listing (JFrog Artifactory Self-Managed Release Notes, 2026-08-28). JFrog's summary advisory table names the same six fixed versions but its "Versions" column is internally inconsistent for the 7.111 branch alone (it prints the fixed version, 7.111.21, as the range's own end rather than the last affected build) so the affected/fixed boundaries above are drawn from the per-release notes, the more granular and internally consistent source, rather than that summary column (JFrog Security Advisories, 2026-08-28). JFrog-hosted cloud environments were already remediated before disclosure and need no customer action (JFrog Security Advisories, 2026-08-28). No party reported observed in-the-wild exploitation at disclosure, but the flaw's own mechanics (pre-auth, no user interaction, network-reachable, full admin takeover) put it in the imminent-exploitation risk class for any instance an attacker could reach, particularly since Artifactory instances custody CI/CD credentials and build artifacts; a risk the update below confirms materialized within days. This is a distinct vulnerability from CVE-2026-66384, the Medium-severity, KEV-listed Docker-cache path-traversal bug on the same product already covered separately (patched 12 August); this critical-severity flaw is the more severe of the two Artifactory vulnerabilities to surface within the same August 2026 release cycle.
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
The flaw carries a CVSS v3.1 base score of 9.8 (Critical) and requires no authentication, privileges, or user interaction to exploit.
Current exploitation status: Actively Exploited
Instances without an additional join key configured receive a 'phantom' join key that attackers can abuse to forge access and mint administrator-level credentials.
Data from watchTowr's global Attacker Eye honeypot network shows attackers minting administrator tokens and enumerating users, groups, credential sets and federated access topologies.
CVE-2026-82329 has moved from disclosed to actively exploited. NCSC Switzerland's advisory, created 2026-09-01, records the current exploitation status as "Actively Exploited" (NCSC Switzerland Cyber Security Hub, 2026-09-01), and watchTowr's own telemetry independently caught the same activity: "this moved from disclosure to real-world exploitation with uncomfortable efficiency," per watchTowr's Yordan Ganchev (The Hacker News, 2026-09-01). Data from watchTowr's global Attacker Eye honeypot network shows attackers minting administrator tokens and enumerating users, groups, credential sets and federated access topologies (SecurityWeek, 2026-09-01). watchTowr names the mechanism: the flaw sits in JFrog Access, the component that issues and validates Artifactory credentials, and an instance with no additional join key configured receives a default "phantom" join key that an unauthenticated attacker can abuse to forge access and mint administrator-level credentials (The Hacker News, 2026-09-01), reconnaissance consistent with staging a software-supply-chain pivot into the binaries and containers Artifactory distributes downstream. As of 1 September, CISA had not yet added CVE-2026-82329 to its Known Exploited Vulnerabilities catalog (SecurityWeek, 2026-09-01).
Given confirmed active exploitation of a pre-auth, no-interaction path to full administrative control of a system that custodies CI/CD credentials and build artifacts, this entry's priority moves to critical.
Defender takeaway (updated): treat any unpatched, internet-reachable, self-hosted instance as already probed. Beyond patching, inspect Artifactory audit logs and JFrog Access logs for admin-scoped tokens minted with no preceding interactive admin login, review newly created or modified users, groups and permission targets, and rotate every credential the instance held.
Builds on: 2026-08-28/cve-2026-66384-jfrog-artifactory-docker-cache-traversal-kev