A critical JFrog Artifactory flaw is being actively exploited to create administrator access tokens on vulnerable self-managed servers. The authentication bypass, tracked as CVE-2026-82329, can give unauthenticated attackers extensive control over software repositories and the packages stored inside them.
JFrog released fixes on August 28. However, organisations that have not yet updated their servers could face a serious software supply-chain risk.
Attackers create their own admin tokens
Security researchers at watchTowr said they observed attackers exploiting the JFrog Artifactory flaw to mint administrator tokens for themselves.
Artifactory acts as a central repository for software packages, binaries and other development assets. Many companies connect build and deployment systems to it, allowing those systems to automatically retrieve trusted components.
An attacker only needs network access to a vulnerable, self-managed Artifactory instance. They do not need valid login credentials before exploiting the flaw.
Once inside, they could enumerate users, groups and federated repository setups. They could also access stored artifacts, alter security settings and change packages that downstream systems trust.
Compromise could spread to build systems
The biggest concern is what administrative access may allow after the initial breach. Attackers could replace legitimate packages with malicious versions, creating a route into build pipelines and production environments.
Collin Hogue-Spears, Senior Director of Solution Management at Black Duck, warned that Artifactory administrators can reach released artifacts already trusted by downstream systems.
That makes the JFrog Artifactory flaw more than a server-level security issue. If attackers poison a package, automated systems may download and execute malicious code without recognising the change.
The full scale of the reported exploitation remains unclear. Researchers have not disclosed victim numbers, attack telemetry or indicators of compromise. It is also not known how many servers attackers successfully breached.
Patching alone may not remove forged tokens
JFrog treats access tokens as separate credentials with their own expiry and revocation controls. As a result, updating the Artifactory software does not automatically invalidate a token that an attacker created before the fix.
Administrators should therefore review access tokens after patching, revoke suspicious credentials and investigate unusual administrative activity. They should also check for unexpected repository changes, altered package metadata and new user or group configurations.
The JFrog Artifactory flaw affects the platform’s default configuration on self-managed installations. JFrog Cloud environments were already protected, according to the vendor.
Fixed Artifactory versions
JFrog addressed CVE-2026-82329 in the following Artifactory releases:
- 7.111.21
- 7.117.28
- 7.125.20
- 7.133.29
- 7.146.38
- 7.161.20
Organisations running an affected self-hosted version should update as soon as possible. They should then rotate and review access tokens, audit administrator activity and inspect repositories for signs of package tampering.
0 responses to “Critical JFrog Artifactory Flaw Lets Attackers Forge Admin Tokens”