A critical authentication bypass vulnerability tracked as CVE-2026-82329 has been discovered in JFrog Artifactory and is being actively exploited in the wild. Attackers are leveraging the flaw to forge tokens that grant full administrative access to affected Artifactory instances. The vulnerability allows threat actors to bypass authentication controls entirely, posing a severe risk to organizations using JFrog Artifactory for software artifact management. Successful exploitation could allow attackers to manipulate build artifacts, inject malicious packages into the software supply chain, or exfiltrate sensitive data. Organizations are urged to apply patches immediately and audit existing admin tokens for signs of unauthorized creation.
CVE-2026-82329 is a critical authentication bypass vulnerability present in the default configuration of self-managed JFrog Artifactory instances. An unauthenticated attacker with network access can exploit the flaw to forge administrative access tokens without valid credentials. These admin tokens allow attackers to enumerate users, groups, and federated topologies, read artifacts, change security configurations, and poison existing packages. Because Artifactory stores binaries and packages consumed by build and deployment pipelines, attackers with admin access could replace trusted artifacts and potentially execute malicious code on downstream systems. Notably, upgrading the Artifactory binary does not invalidate already-issued tokens, as JFrog treats access tokens as independent credentials with their own expiration and revocation mechanisms. Active exploitation was observed by watchTowr, with attackers minting their own admin tokens. JFrog Cloud environments were protected prior to the patch.
1. Immediately upgrade self-managed JFrog Artifactory instances to one of the patched versions: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. 2. After patching, audit and revoke all existing admin access tokens, as upgrading the binary alone does not invalidate previously issued tokens. 3. Review token issuance logs for any unauthorized or suspicious admin token creation prior to patching. 4. Inspect stored artifacts for signs of tampering or package poisoning. 5. Audit downstream build and deployment systems that pull from Artifactory for any malicious or unexpected artifacts. 6. Restrict network access to Artifactory instances to only trusted sources where possible. 7. JFrog Cloud users are already protected and no action is required for those environments.
