Critical JFrog Artifactory Flaw Exploited for Admin Tokens
Threat actors began exploiting CVE-2026-82329, a critical JFrog Artifactory authentication-bypass vulnerability, just days after its public disclosure. The flaw carries a CVSS score of 9.8 and allows an unauthenticated attacker with network access to obtain administrative privileges on Artifactory instances using default configuration. JFrog released version 7.161.20 on August 28, 2026, while exploitation was confirmed by September 1.
According to watchTowr principal threat intelligence specialist Yordan Ganchev, the issue is located in JFrog Access, which issues and validates credentials. When no additional join key is configured, the service creates a predictable “phantom” join key that attackers can exploit to forge access and mint administrator-level tokens. Attackers have already used the technique to enumerate users, groups, credential sets, and federated-access structures. Vercel CEO Guillermo Rauch warned that Artifactory’s role as a repository for software binaries makes successful exploitation especially dangerous, potentially enabling supply-chain poisoning, pipeline tampering, lateral movement, and malicious downstream releases.
The vulnerability affects Artifactory versions 7.161.0 through 7.161.19, 7.146.0 through 7.146.36, 7.133.0 through 7.133.28, 7.125.0 through 7.125.19, 7.117.0 through 7.117.27, and 7.111.4 through 7.111.21. Organizations with self-managed deployments should immediately move to a vendor-supported fixed version, prioritize internet-facing installations, and use a port scanner to assess external exposure. Administrators should also review JFrog Access and Artifactory audit logs for forged administrator tokens, unusual administrative activity, and unexpected access to user, group, or credential data.
Because attackers can mint administrative credentials, incident responders should rotate exposed passwords, API keys, signing secrets, and connected service credentials, then investigate build systems and repositories for unauthorized changes or backdoors. Teams can verify the security of exposed endpoints with an SSL/TLS checker and use a password checker to screen replacement credentials for known exposure. JFrog’s own research indicates exploitation has moved rapidly from disclosure to active abuse, leaving vulnerable deployments at immediate risk of administrative takeover and software-supply-chain compromise.