- jfrog
- artifactory
- auth-bypass
- cve-2026-82329
- supply-chain
- kev
news
JFrog Artifactory Default Join-Key Auth Bypass (CVE-2026-82329)
Self-hosted Artifactory Access service treats a blank cluster join key as trusted — unauthenticated admin-token minting, exploited from 2026-09-01, CISA KEV 2026-09-02.
Summary
CVE-2026-82329 is a CVSS 9.8 authentication bypass in self-hosted JFrog Artifactory (JFrog Access). Under the default configuration, the Access service splits “additional join keys” on commas without dropping empty entries. An empty config therefore inserts a blank join key into the trusted set. Join keys are the HMAC secrets used to validate cluster-join requests on an unauthenticated Access endpoint. A blank key is deterministic, so an unauthenticated attacker who can reach Access can mint a service-scoped admin token and exchange it for a long-lived platform admin token.
JFrog disclosed on 2026-08-28. watchTowr reported exploitation on 2026-09-01 (admin-token minting, then enumeration of users, groups, credentials, and federated topologies). CISA added the CVE to KEV on 2026-09-02. JFrog Cloud is stated as already protected; this is a self-hosted problem. Fastly later described opportunistic mass scanning.
Patching does not revoke tokens already minted. Rotate Access/Artifactory credentials and audit admin-token issuance since 2026-08-28.
OFFSITE.DARK indexes CISA, JFrog, and defender reporting. Forged-JWT construction is omitted.
Key Findings
| Finding | Detail |
|---|---|
| CVE | CVE-2026-82329 (CWE-287) |
| CVSS | 9.8 |
| Component | JFrog Access (cluster join / token issue) |
| Root cause class | Empty string accepted as a trusted join key on default install |
| Outcome | Unauthenticated administrative token |
| Cloud vs self-hosted | Cloud protected; self-hosted exposed |
| Exploitation | watchTowr: 2026-09-01; CISA KEV: 2026-09-02 |
| Hunt signal | Join success tied to the well-known empty-string key id (SHA-256 of "") |
Fixed versions (do not stop short)
JFrog fixed the blank-key acceptance on these branch heads (confirm against the current JFrog advisory):
| Branch | Minimum fixed build |
|---|---|
| 7.111 | 7.111.21 |
| 7.117 | 7.117.28 |
| 7.125 | 7.125.20 |
| 7.133 | 7.133.29 |
| 7.146 | 7.146.38 |
| 7.161 | 7.161.20 |
A separate Artifactory KEV (path traversal, CVE-2026-66384) had federal due dates landing on 7.146.35 / 7.161.16 — those builds do not close CVE-2026-82329. Stopping three or four builds short of the table above is still vulnerable.
Impact
- Artifactory is the binary source of truth for many CI systems. Admin on Artifactory is supply-chain RCE one
npm publish/ Docker push later. - Tokens minted in the exposure window remain valid after the version bump.
- Internet-exposed Access/Artifactory APIs are mass-scannable; Fastly saw the jump from probe to opportunistic exploitation.
Mitigation
- Upgrade to a fixed build in the table above, not merely the previous KEV close-out.
- Revoke Access tokens issued since 2026-08-28; rotate admin passwords, API keys, and federation secrets.
- Hunt Access logs for cluster-join HTTP 201 events whose key id is the SHA-256 of the empty string (
e3b0c442…— a defender IOC, not a secret). - Do not leave Access (
/access/) on the public internet; require SSO and network allowlists. - Assume poisoned artifacts if admin was reachable: pin and re-sign critical packages; review recent publishes.
Related Signals
- Coder registry Terraform compromise
- Shai-Hulud npm resurrection
- PolinRider NK supply chain
- CISA KEV September 2026 cluster
Sources
- CISA — seven KEV additions
- Fastly — CVE-2026-82329 exploitation activity
- JFrog Security Advisory — authentication bypass leading to administrative access (2026-08-28)