JFrog Artifactory CVE-2026-82329: CVSS 9.8 Auth Bypass Exploited in 4 Days

JFrog Artifactory CVE-2026-82329: CVSS 9.8 Auth Bypass Exploited in 4 Days

Your Artifactory instance might already be compromised — and you wouldn't know it. CVE-2026-82329, a critical authentication bypass in JFrog Artifactory, went from patch to active exploitation in about four days (~96 hours). Attackers are minting admin tokens on unpatched instances right now. If you run self-hosted Artifactory, this is not a "next sprint" fix. This is a drop-everything situation.

What CVE-2026-82329 Actually Does

The vulnerability is classified as CWE-287 (Improper Authentication). Under Artifactory's default configuration, an unauthenticated attacker with network access can bypass the authentication mechanism and obtain a full administrator token. No credentials required. No user interaction. No phishing. Just network access to the instance.

The CVSS v3.1 vector tells the whole story:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Confidentiality/Integrity/Availability: All High

That's a 9.8 out of 10. The only thing stopping a perfect 10 is that scope is unchanged.

How the Bypass Works

Artifactory issues access tokens for API authentication across its REST interface — the same interface CI/CD pipelines use to push and pull packages. The bug allows an unauthenticated caller to trigger the token-issuing logic in a way that returns an admin-scoped token instead of failing the request.

Once an attacker holds a valid admin token, they can:

• Create new privileged users
• Modify repository permissions
• Pull proprietary source code from private repositories
• Push modified or backdoored packages into circulation
• Delete or corrupt build artifacts

The attack is a single HTTP request. No exploit chain. No privilege escalation steps. No memory corruption. It's a logic error in authentication code, and those tend to get found by automated scanners within days of a patch going public.

Affected Versions

Six release branches carry the flaw. If you haven't deliberately tracked patch versions, you're probably running an affected build:

Affected Artifactory version ranges (CVE-2026-82329):
7.161.0  → 7.161.19
7.146.0  → below 7.146.38
7.133.0  → 7.133.28
7.125.0  → 7.125.19
7.117.0  → 7.117.27
7.111.4  → 7.111.21

Fixed versions: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 (released August 28, 2026)

Cloud-hosted Artifactory customers were patched automatically by JFrog. Self-hosted deployments had to patch manually — and that's where the exploitation happened.

Timeline: Patch to Exploitation in ~96 Hours

That last point is worth noting. CISA's Known Exploited Vulnerabilities catalog exists to flag vulnerabilities that federal agencies must remediate on an accelerated clock. CISA added this flaw the day after public exploitation reports, with a September 5 deadline — fast by bureaucratic standards, still four days after the patch. About four days from patch to exploitation sits just above the 72-hour window Malaysia's PDPA gives you to notify the Commissioner — the 72-hour rule.

Why This Matters: Software Supply Chain at Risk

Artifactory sits at the center of the software supply chain. It stores build artifacts, container images, npm modules, PyPI wheels, Maven jars, NuGet packages, and Helm charts. Enterprises use it as the single source of truth for what gets deployed into production.

An attacker with admin access to Artifactory can:

1. Poison packages — Replace a trusted internal package with a backdoored version
2. Steal secrets — Pull proprietary source code and build secrets from private repos
3. Pivot downstream — Every build that resolves a tampered dependency inherits the backdoor
4. Cover tracks — Modify audit logs and artifact checksums to look internally consistent

This is the same category of risk that drove SolarWinds, Codecov, and XZ Utils incidents. The difference: CVE-2026-82329 targets the registry infrastructure itself, not a single package. For the parallel story in geospatial infrastructure, see the ArcGIS vulnerability wave.

Detection: Is Your Instance Compromised?

Check Artifactory's access and audit logs for these indicators:

Indicators of compromise:
- Admin-scoped tokens created since Aug 28, 2026 from unknown sources
- Repository permission changes outside normal change windows
- Unexpected artifact uploads or overwrites
- Authentication attempts against admin endpoints from unfamiliar IPs
- New user accounts with admin privileges

Because the exploit requires no user interaction, there's no phishing email or malicious attachment to hunt for. The entire attack lives inside Artifactory's own access and audit trails.

Remediation: Step-by-Step

Step 1: Upgrade Immediately

Pick the patch version matching your current release branch:

# Check your current version
curl -u admin:password https://your-artifactory/api/system/ping

# Or check the UI: Administration → Platform → Runtime Info

# Download and apply the fix for your branch
# For 7.161.x branch:
wget https://releases.jfrog.io/artifactory/artifactory-pro/org/artifactory/artifactory-server/7.161.20/artifactory-server-7.161.20.zip

# Stop Artifactory
sudo systemctl stop artifactory

# Backup current installation
cp -r /opt/jfrog/artifactory /opt/jfrog/artifactory-backup-$(date +%Y%m%d)

# Extract new version
unzip artifactory-server-7.161.20.zip -d /opt/jfrog/

# Start Artifactory
sudo systemctl start artifactory

# Verify version
curl -u admin:password https://your-artifactory/api/system/ping

Step 2: Rotate All Admin Tokens

Patching closes the door. It does NOT invalidate tokens an attacker already minted.

# List all tokens
curl -u admin:password https://your-artifactory/api/security/tokens

# Revoke any token you don't recognize
curl -u admin:password -X POST \
  https://your-artifactory/api/security/tokens/{token-id} \
  -H "Content-Type: application/json" \
  -d '{"token_id": "suspicious-token-id"}'

# Or revoke ALL tokens and regenerate from scratch (recommended)
curl -u admin:password -X DELETE \
  https://your-artifactory/api/security/tokens

Step 3: Audit Repository Permissions

# Check for permission changes
curl -u admin:password https://your-artifactory/api/security/permissions | jq '.[] | select(.name | contains("admin"))'

# Look for any new or modified permissions created after Aug 28
# Revoke unauthorized permissions immediately

Step 4: Restrict Network Access

Move Artifactory admin endpoints behind VPN or IP allowlists:

# nginx example: restrict /api/security to trusted IPs only
location /api/security {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    proxy_pass http://artifactory:8081;
}

Step 5: Enable Enhanced Logging

<!-- $ARTIFACTY_HOME/etc/logback.xml -->
<!-- Add verbose audit logging for auth and token events -->
<logger name="org.artifactory.security" level="DEBUG"/>
<logger name="org.artifactory.token" level="DEBUG"/>

Step 6: Verify the Fix

# Confirm patched version
curl -u admin:password https://your-artifactory/api/system/ping | jq '.version'

# Should return 7.161.20 or higher

# Test that auth bypass is blocked
curl -v https://your-artifactory/api/security/tokens
# Should return 401 Unauthorized (not admin tokens)

Comparison: CVE-2026-82329 vs Other 2026 Supply Chain Flaws

Two JFrog advisories in a single week is an unusually tight clustering. It suggests either a coordinated internal security review turned up multiple issues at once, or external researchers were probing the same product in parallel.

What Security Teams Should Do Right Now

1. Confirm your version — Check Administration → Platform → Runtime Info
2. Patch today — Not next maintenance window, today
3. Rotate admin tokens — Especially anything created after Aug 28
4. Audit access logs — Look for suspicious token creation events
5. Restrict network access — Admin endpoints should not be internet-exposed
6. Review artifact integrity — Compare recently modified packages against known-good checksums

The window between disclosure and exploitation keeps shrinking. Treat the vendor's release date as the actual deadline, not a recommendation.

Sources

• JFrog Security Advisories
• JFrog Artifactory Self-Managed Releases
• WatchTowr: Critical JFrog Artifactory Vulnerability Exploited
• NVD: CVE-2026-82329
• The Hacker News: Attackers Exploit Critical JFrog Artifactory Bug