Attackers Exploit Critical JFrog Artifactory Authentication Bypass Days After Patch
Summary
Attackers are exploiting CVE-2026-82329, an unauthenticated authentication bypass in default JFrog Artifactory configurations, to mint admin tokens and enumerate users. JFrog patched the flaw in version 7.161.20.
Key points
- CVE-2026-82329 is a critical authentication bypass in JFrog Access; unauthenticated attackers with network access may gain administrative privileges on default configurations.
- Affected releases include 7.161.0–7.161.19, 7.146.0–7.146.36, 7.133.0–7.133.28, 7.125.0–7.125.19, 7.117.0–7.117.27, and 7.111.4–7.111.21.
- JFrog released Artifactory version 7.161.20, which patches the flaw, on August 28, 2026.
- According to watchTowr, attackers began weaponizing the vulnerability on September 1 to mint administrator tokens and enumerate users, groups, credential sets, and federated access topologies.
- The article warns that administrative access could enable build-pipeline tampering, movement into production systems, and potentially malicious software changes reaching downstream customers.
- JFrog recommends promptly patching internet-exposed self-managed instances, inspecting audit logs, rotating exposed credentials, and checking connected systems for malicious changes or backdoor access.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- Critical (CVSS 9.8)
- Affected Versions
- JFrog Artifactory 7.161.0–7.161.19
- JFrog Artifactory 7.146.0–7.146.36
- JFrog Artifactory 7.133.0–7.133.28
- JFrog Artifactory 7.125.0–7.125.19
- JFrog Artifactory 7.117.0–7.117.27
- JFrog Artifactory 7.111.4–7.111.21
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available