Attackers began exploiting a critical authentication bypass in JFrog Artifactory on Sept. 1, just days after the patch shipped, according to exposure-management firm watchTowr, The Hacker News reported. The flaw, CVE-2026-82329 (CVSS 9.8), can give an unauthenticated attacker administrative access to the artifact repository at the center of many software supply chains.
“JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges,” the CVE description says. JFrog fixed it in Artifactory 7.161.20, released Aug. 28.
A ‘phantom’ join key
The bug is in JFrog Access, the component that issues and validates credentials. “Instances without an additional join key configured receive a ‘phantom’ join key that attackers can abuse to forge access and mint administrator-level credentials,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr.
Vulnerable releases include:
- 7.161.0 through 7.161.19
- 7.146.0 through 7.146.36
- 7.133.0 through 7.133.28
- 7.125.0 through 7.125.19
- 7.117.0 through 7.117.27
- 7.111.4 through 7.111.21
“It affects default configs, requires no auth, no user interaction,” Vercel CEO Guillermo Rauch wrote on LinkedIn. “It’s an RCE bomb because Artifactory hosts binaries, so you can basically poison everything, but an admin escalation can cause damage even beyond that.”
What attackers are doing
WatchTowr’s honeypots recorded attackers generating admin tokens and enumerating users, groups, credential sets and federated access topologies. “This moved from disclosure to real-world exploitation with uncomfortable efficiency,” Ganchev said. “Anyone following along knows what comes next: things will get worse.”
The attempts came from a small number of IP addresses in various geographies, and watchTowr hasn’t seen broad scanning or mass exploitation yet. Some attackers exploited the flaw only to confirm it worked. Others probed instances to decide whether they were worth more effort, and “in limited cases, threat actors created backdoor users,” Ganchev said.
He warned that admin access to a central artifact system lets attackers “tamper with build pipelines, move laterally into production systems and potentially push malicious changes downstream to customers.”
What to do
Teams running self-managed Artifactory should patch internet-exposed instances immediately. They should also review audit logs for unexpected token creation and new users, rotate any credentials that may have been exposed, and check connected build and deployment systems for unauthorized changes.
WebProNews is an iEntry Publication