Attackers Exploit a JFrog Artifactory Bug in Four Days

Attackers began forging administrator credentials on internet-facing JFrog Artifactory servers within four days of the company shipping a fix, according to exposure-management firm watchTowr, which says its honeypot network caught the first attempts on Sept. 1.

JFrog patched the flaw, tracked as CVE-2026-82329 and rated 9.8 out of 10 on the CVSS scale, on Aug. 28 with Artifactory 7.161.20 and five other point releases. The Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on Sept. 2, giving federal agencies until Sept. 5 to remediate. That deadline passed 12 days before this report.

A key that was never set

Artifactory uses a cluster join key, a shared secret, to let new nodes authenticate to the internal service that issues every credential on the platform, called JFrog Access. According to security firm Bishop Fox, which published its own technical breakdown on Sept. 11, installations that never configure an additional join key fall back to a value the vulnerable code computes from an empty string rather than treating it as unset.

That empty string hashes with SHA-256 to a fixed, publicly knowable constant. Three separate checks fail to catch it: a guard tests whether a lookup wrapper is empty rather than the string inside it, splitting an empty string on commas still produces one element, and a validator confirms the result is valid hexadecimal without confirming a key exists at all. "One unauthenticated request therefore buys a permanent Access administrator credential," Bishop Fox's Nate Robb, a senior operator at the firm, wrote in the analysis.

watchTowr's principal threat intelligence specialist, Yordan Ganchev, described the result as a "phantom" join key: a credential any attacker can derive without ever seeing the server. "This moved from disclosure to real-world exploitation with uncomfortable efficiency," Ganchev said, according to CSO Online. Once minted, the forged token lets an attacker generate further administrator tokens and enumerate users, groups, credential sets and federated access relationships.

Why Artifactory access matters beyond one server

Artifactory sits in the path between a developer's commit and the binary that ships, storing the packages and containers that build pipelines pull from. Collin Hogue-Spears, Black Duck's senior director of solution management, told CSO Online that "admin on Artifactory means admin on its own checks," meaning an attacker with that access can alter what a pipeline trusts, not just read what is stored.

Affected branch	Vulnerable range	Fixed version
7.161.x	7.161.0-7.161.19	7.161.20
7.146.x	7.146.0-7.146.36	7.146.38
7.133.x	7.133.0-7.133.28	7.133.29
7.125.x	7.125.0-7.125.19	7.125.20
7.117.x	7.117.0-7.117.27	7.117.28
7.111.x	7.111.4-7.111.21	7.111.21

For self-hosted operators who cannot upgrade immediately, JFrog's advisory recommends setting a randomly generated additionalJoinKeys value in system.yaml so the server stops accepting the empty-string default. JFrog has not said how many customers were still running an unset join key when the patch shipped, and watchTowr has not said how many servers it has observed compromised beyond the initial honeypot hits.

The flaw is the second supply chain vulnerability this month to put a build pipeline's trust chain at risk rather than a single application, following the GitHub token exposure at Baseten. Both cases turned on a credential an operator assumed was private staying that way by default, rather than by configuration.