Attackers Exploit Critical JFrog Artifactory Flaw to Forge Admin Tokens
Summary
watchTowr observed active exploitation of CVE-2026-82329, an authentication bypass that lets unauthenticated attackers mint Artifactory admin tokens. JFrog released fixes; the extent of any compromise is unclear.
Key points
- The flaw affects default configurations of self-managed JFrog Artifactory and can let attackers with network access create administrative tokens without authentication.
- watchTowr observed the flaw being exploited; JFrog had not confirmed the reported activity at publication time.
- Admin access can expose users, groups, artifacts and security settings, and could allow attackers to poison packages trusted by downstream build and deployment systems.
- JFrog released fixes on August 28 in versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20; JFrog said its cloud environments were already protected.
- An expert quoted in the article cautioned that upgrading alone does not invalidate previously issued access tokens, which have separate expiration and revocation mechanisms.
- The extent of compromise, victim count, telemetry details and indicators of compromise were unclear.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
People
Collin Hogue-SpearsBlack Duck Senior Director of Solution Management who described how administrative access could expose artifacts trusted by downstream systems.Guillermo RauchVercel CEO who warned about the vulnerability's potential impact beyond Artifactory and speculated about a possible connection to AI-agent research.