CVE-2026-82329

What is JFrog Artifactory?

JFrog Artifactory is the dominant enterprise binary repository manager — the system of record for build artifacts, container images, and package feeds (Maven, npm, PyPI, Docker, and dozens more) across CI/CD pipelines. Because every build pulls dependencies from it and every release passes through it, administrative control of an Artifactory instance is a software-supply-chain compromise: an attacker can poison artifacts consumed by every downstream build and deployment.

Overview

CVE-2026-82329 is an improper-authentication flaw (CWE-287, CVSS 9.8) in JFrog Access, the component that issues and validates Artifactory credentials. On self-hosted instances running a default configuration (no additional join key configured), an unauthenticated network attacker can abuse a "phantom" join key to forge access tokens and mint administrator-level credentials. Exploitation began within days of the 2026-08-28 disclosure, and CISA added it to KEV on 2026-09-02 with an accelerated 2026-09-05 deadline.

Affected Versions

Self-hosted Artifactory (JFrog Cloud was patched by JFrog directly):

Consult the JFrog security advisory for authoritative per-branch fix builds — third-party reports differed slightly on exact numbers.

Technical Details

The join key is the shared secret JFrog services use to enroll with the Access service and obtain tokens. The flaw: instances without an explicitly configured additional join key effectively honor a predictable "phantom" join key. An attacker who can reach the instance over the network can use it to forge the token-issuance flow and mint tokens with administrative scope — no credentials, no user interaction, low complexity, default configurations affected.

With a minted admin token, the attacker owns the instance: repositories, users, permission targets, and — most dangerously — the build artifacts every downstream consumer trusts.

Discovery

JFrog disclosed the vulnerability with the 2026-08-28 patch release; public discovery credit was not given. In-the-wild exploitation was first reported by watchTowr.

Exploitation Context

watchTowr observed exploitation beginning around 2026-09-01, roughly three days after disclosure. Attackers were seen minting administrator tokens, creating backdoor accounts, and enumerating users, groups, stored credentials, and federated access topology — triage activity consistent with selecting high-value targets for deeper supply-chain compromise. No threat actor has been named and no exposure counts published, but the speed of weaponization plus CISA's three-day federal deadline mark this as one of the most urgent KEV additions of the batch.

Remediation

1. Upgrade immediately to 7.161.20 or your branch's fixed build (table above). Federal deadline: 2026-09-05.
2. Configure an explicit join key and rotate join/master keys as directed in JFrog's advisory — patching alone does not evict an attacker who already minted tokens.
3. Assume-breach review for any instance that was internet-reachable while vulnerable: audit users and groups for accounts you didn't create, review access tokens issued since 2026-08-28, check admin-action audit logs, and revoke/reissue all access tokens.
4. Verify artifact integrity: compare checksums of recently modified artifacts against known-good builds; treat unexplained artifact changes as a supply-chain incident.
5. Remove direct internet exposure of Artifactory where possible — front it with VPN or an authenticating proxy.