Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
- ID
- 20373
- Status
- summarized
- Published
- 02 Sep 2026, 1:53 AM
- Fetched
- 02 Sep 2026, 3:11 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 02 Sep 2026, 3:14 AM
- Tags
- Audience
- developersvibe_coders
What happened
A critical authentication bypass flaw (CVE-2026-82329, CVSS 9.8) in JFrog Artifactory is being actively exploited as of September 1, 2026, just days after disclosure. The vulnerability in JFrog Access allows unauthenticated attackers to forge admin credentials using a 'phantom' join key in default configurations, enabling token minting, user enumeration, and potential supply chain poisoning of build pipelines. JFrog patched it in version 7.161.20 on August 28, 2026, but multiple older release branches (7.111 through 7.161) remain vulnerable.
Why it matters
If your team runs self-managed JFrog Artifactory on any of the affected versions (7.111.4–7.161.19 across six branches), patch to 7.161.20 or the fixed point release for your branch immediately—attackers are already minting admin tokens and enumerating credentials on unpatched instances. This is not theoretical: the flaw requires no authentication and affects default configs, meaning any internet-exposed instance is likely compromised or will be soon. If you cannot patch right now, restrict network access to the Artifactory instance as a stopgap.
Discussion angle
How many of us actually know if our CI/CD pipeline uses self-managed Artifactory vs. JFrog Cloud—and do we have an inventory of which instances are internet-exposed? This is a good prompt to audit artifact repository exposure before the next zero-day hits.