CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited Days After Disclosure

Key facts for JFrog phantom join key

Detection coverage for JFrog phantom join key

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2287 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: JFrog Artifactory Admin Token Minted via Phantom Join Key (CVE-2026-82329) — SPL

Detects an administrator-scoped Artifactory access token issued by the JFrog Access subsystem with no preceding authenticated actor session — the phantom-join-key forgery mechanic underlying CVE-2026-82329, where a self-managed instance without an explicit configured join key issues an implicit/predictable key that an unauthenticated network attacker can abuse to forge trust material and mint admin tokens directly.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1606, T1552
• Data sources: jfrog_access_audit_log, jfrog_artifactory_request_log, network_proxy_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=jfrog sourcetype="jfrog:access:audit" event_type="CREATE_TOKEN"
| eval is_admin_scope=if(match(token_scope, "(?i)admin"), 1, 0)
| where is_admin_scope=1
| where auth_method="join_key" OR auth_method="anonymous" OR isnull(actor) OR actor=""
| stats count min(_time) as first_seen max(_time) as last_seen values(client_ip) as client_ips values(token_scope) as scopes by instance_id
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| eval alert="Admin-scope token minted via phantom/implicit join key with no authenticated actor"
| table instance_id first_seen last_seen client_ips scopes count alert

Microsoft KQL

JFrogAccessLogs_CL
| where TimeGenerated > ago(24h)
| where EventType_s == "CREATE_TOKEN"
| where TokenScope_s has "admin"
| where AuthMethod_s in ("join_key", "anonymous", "") or isempty(Actor_s)
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ClientIPs=make_set(ClientIP_s), Scopes=make_set(TokenScope_s) by InstanceId_s
| project InstanceId_s, Count, FirstSeen, LastSeen, ClientIPs, Scopes

Sigma

title: JFrog Artifactory Admin Token Minted via Phantom Join Key (CVE-2026-82329)
id: a1e4c2d0-6f3b-4c8e-9a21-7d3f5b6e1001
status: experimental
description: Detects an administrator-scoped Artifactory access token issued by the JFrog Access subsystem without a preceding authenticated actor session, consistent with phantom-join-key forgery abuse of CVE-2026-82329.
references:
    - https://docs.jfrog.com/releases/docs/jfrog-security-advisories
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-82329
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-01
tags:
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1606
    - attack.t1552
    - cve.2026.82329
logsource:
    category: application
    product: jfrog
    service: access
detection:
    selection:
        EventType: 'CREATE_TOKEN'
        TokenScope|contains: 'admin'
    filter_authenticated:
        AuthMethod:
            - 'join_key'
            - 'anonymous'
    condition: selection and filter_authenticated
falsepositives:
    - Legitimate first-time instance bootstrap issuing an initial admin token via join key
    - Automation/CI service accounts intentionally configured for join-key-based token issuance
level: critical

Known false positives:

• Legitimate first-time instance bootstrap issuing an initial admin token via join key before an explicit key is configured
• Automation or CI service accounts intentionally configured to authenticate via join-key-based token issuance

Tuning notes: Baseline known automation/CI accounts and their expected join-key token issuance windows, then suppress the documented first-run bootstrap event; alert only on admin-scope token creations occurring after initial setup, and cross-check `instance_id` against the patched-version inventory (7.111.21/7.117.28/7.125.20/7.133.29/7.146.38/7.161.20) to suppress already-remediated hosts.

• 🔒 JFrog Artifactory Admin Token Minted via Phantom Join Key (CVE-2026-82329) — KQL · unlock with TL Creds
• 🔒 Forged-Admin-Token Mass Enumeration of Users, Groups, and Federated Repositories — KQL · unlock with TL Creds
• 🔒 Federated Replication Reconfiguration Shortly After Forged Admin-Token Mint (Supply-Chain Pivot) — KQL · unlock with TL Creds
• 🔒 JFrog Artifactory Admin Token Minted via Phantom Join Key (CVE-2026-82329) — Sigma · unlock with TL Creds
• 🔒 Forged-Admin-Token Mass Enumeration of Users, Groups, and Federated Repositories — Sigma · unlock with TL Creds
• 🔒 Federated Replication Reconfiguration Shortly After Forged Admin-Token Mint (Supply-Chain Pivot) — Sigma · unlock with TL Creds
• 🔒 Forged-Admin-Token Mass Enumeration of Users, Groups, and Federated Repositories — SPL · unlock with TL Creds
• 🔒 Federated Replication Reconfiguration Shortly After Forged Admin-Token Mint (Supply-Chain Pivot) — SPL · unlock with TL Creds

Indicators of compromise for JFrog phantom join key

As of 2026-11-02, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-2287.

Sample indicators (3 of 33)

• IP address: 213.136.72[.]87
• File hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• IP address: 89.117.49[.]147

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

How JFrog phantom join key works

31, 2026 — three days after JFrog's Aug. 28 disclosure and patch release — with attackers minting forged admin tokens and enumerating users, groups, credential sets, and federated access topologies; a public proof-of-concept from Pruva and ethical hacker Souhaib Naceri followed, raising the risk of broader exploitation.

CVE-2026-82329 is a CWE-287 (Improper Authentication) flaw in JFrog Artifactory's JFrog Access identity and token-issuance subsystem. Under Artifactory's default configuration, self-managed instances that have not had an additional, explicit join key configured are issued an implicit 'phantom' join key by JFrog Access. Because this phantom key is predictable/derivable rather than a genuine per-instance secret, an unauthenticated attacker with network access to the instance can abuse it to forge trust material and mint administrator-level access tokens without ever presenting valid credentials. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — no authentication, no privileges, and no user interaction are required, and successful exploitation yields full confidentiality, integrity, and availability impact.

JFrog disclosed the vulnerability and shipped patched builds across all six affected 7.x self-managed release branches on Aug. 28, 2026; JFrog Artifactory Cloud (SaaS) customers were already patched automatically and required no action. Three days later, on Aug. 31, 2026, watchTowr's global Attacker Eye honeypot network reported observing real-world exploitation attempts against CVE-2026-82329: attackers used the phantom-join-key forgery technique to mint themselves valid administrator tokens, then used those tokens to enumerate user accounts, permission groups, stored credential sets, and federated repository/access topologies — reconnaissance that maps directly to the blast radius an attacker would need to understand before pivoting into build pipelines or exfiltrating secrets. watchTowr characterized the observed activity as originating from a small number of IP addresses spread across varying geographies and attributed to multiple distinct threat actors, with broad mass-scanning not yet observed but considered likely to follow.

Shortly after watchTowr's report, security researchers at Pruva, working with ethical hacker Souhaib Naceri, published a proof-of-concept exploit for CVE-2026-82329 and reported readily reproducing the phantom-join-key forgery, further lowering the barrier to mass exploitation. Because Artifactory sits at the center of software build and release pipelines for a large share of enterprise DevOps environments — JFrog reports serving a majority of the Fortune 100 and a broad customer base spanning technology, financial services, healthcare, retail, and government — an attacker who obtains administrator access to a self-managed instance gains control over repositories, stored credentials, build artifacts, and federated replication relationships, with a realistic path to tampering with or substituting malicious software packages and thereby compromising the downstream software supply chain. Given the confirmed active exploitation, the low complexity of the attack, and the now-public PoC, JFrog Artifactory administrators who have not yet upgraded should treat any unpatched, internet-exposed self-managed instance as potentially already compromised.

MITRE ATT&CK techniques by tactic:

Discovery

T1018 Remote System Discovery; T1069 Permission Groups Discovery; T1087 Account Discovery

Privilege Escalation

T1078 Valid Accounts

Persistence

T1136 Create Account

Initial Access

T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Collection

T1213 Data from Information Repositories

lateral-movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Credential Access

T1552 Unsecured Credentials; T1606 Forge Web Credentials

Resource Development

T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation for JFrog phantom join key

Patches

• Artifactory 7.111.21
• Artifactory 7.117.28
• Artifactory 7.125.20
• Artifactory 7.133.29
• Artifactory 7.146.38
• Artifactory 7.161.20

Immediate actions

• Upgrade all self-managed Artifactory instances to the patched build matching their release branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20
• Audit existing administrator tokens and revoke any unrecognized or unexpectedly issued admin-level tokens
• Restrict network access to the Artifactory administrative interface to trusted internal networks only if immediate patching is not possible
• Review JFrog Access authentication logs for anomalous token-issuance events and unfamiliar source IPs

Workarounds

• Restrict administrative interface access to trusted internal networks via firewall/network ACLs pending patching
• JFrog Artifactory Cloud (SaaS) customers require no action — already patched automatically by JFrog

Longer-term hardening

• Configure an explicit, non-default join key on every self-managed Artifactory instance rather than relying on the implicit phantom join key
• Treat any unpatched, internet-exposed Artifactory instance as potentially compromised and rotate all credentials/tokens stored within it
• Monitor federated repository topologies for unauthorized replication relationships or access changes

Affected and fixed versions

• JFrog — Artifactory Self-Managed
  Vulnerable versions: 7.111.4-7.111.20; 7.117.0-7.117.27; 7.125.0-7.125.19; 7.133.0-7.133.28; 7.146.0-7.146.36; 7.161.0-7.161.19
  Fixed in: 7.111.21; 7.117.28; 7.125.20; 7.133.29; 7.146.38; 7.161.20

Timeline of JFrog phantom join key

Last updated 2026-11-02 · revalidated 1× · latest source

• 2026-08-28 NVD publishes the CVE-2026-82329 record with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CWE-287 (Improper Authentication) classification.
• 2026-08-28 locked-ioc-32 ships patched builds across all six affected self-managed release branches (7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20); Artifactory Cloud (SaaS) is patched automatically with no customer action required.
• 2026-08-28 locked-ioc-32 publicly discloses CVE-2026-82329, a CVSS 9.8 authentication-bypass vulnerability in Artifactory's locked-ioc-28 subsystem stemming from an implicit 'phantom' join key issued to instances without an explicit join key configured.
• 2026-08-31 Fastly records about 75,000 attempts against the registry join endpoint, mostly offensive security testing, after single-digit probing on 08-28 to 08-30; about 171,000 attempts follow on 09-01 once a public PoC appears.
• 2026-08-31 NVD's last-modified date for CVE-2026-82329 updates to reflect the confirmed active-exploitation status reported by locked-ioc-31.
• 2026-08-31 locked-ioc-31's global Attacker Eye honeypot network reports observing active in-the-wild exploitation of CVE-2026-82329, with attackers minting forged administrator tokens and enumerating users, groups, credential sets, and federated access topologies on compromised instances.
• 2026-09-01 Dark Reading, The Hacker News, SecurityWeek, SC World, The Register, and Cybersecurity News publish coverage of the active exploitation, the phantom-join-key mechanism, and the supply-chain risk to Artifactory-hosted build pipelines.
• 2026-09-01 Security researchers at locked-ioc-33, working with ethical hacker locked-ioc-23, publish a proof-of-concept exploit for CVE-2026-82329 and report readily reproducing the phantom-join-key forgery, lowering the barrier for broader exploitation.
• 2026-09-02 CISA adds CVE-2026-82329 to the Known Exploited Vulnerabilities catalog; Fastly records peak activity of about 406,000 attempts, including mass scanning from French and US VPS hosts.
• 2026-09-05 CISA KEV remediation due date for federal agencies.
• 2026-09-11 Bishop Fox publishes the root-cause analysis (empty cluster join key accepted as an HS256 signing key), patch diff and two non-exploitative static JWT detection probes.

Update history

• 2026-11-02 — CVE-2026-82329: Unauthenticated Administrative Access in locked-ioc-32 Artifactory via Empty Cluster Join Key: What changed No field escalation: severity (CRITICAL), exploitability (ACTIVE) and status (ACTIVE) already reflect the evidence. The update adds CISA KEV listing (2026-09-02), Fastly scan-volume telemetry (about 75k, 171k and 406k daily att

Sources cited for JFrog phantom join key

• JFrog Security Advisories docs.jfrog.com · Advisory · 2026-08-28
• NVD - CVE-2026-82329 Detail NVD (NIST) · Advisory · 2026-08-28
• Rapid7 Vulnerability & Exploit Database - CVE-2026-82329 Rapid7 · Research · 2026-08-28
• IONIX Threat Center - CVE-2026-82329 ionix.io · Research · 2026-08-28
• watchTowr Intel on X: active exploitation of CVE-2026-82329 x.com · Blog · 2026-08-31
• Attackers Jump on Critical Artifactory Flaw After Disclosure Dark Reading · News · 2026-09-01
• Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens The Hacker News · News · 2026-09-01
• Another Artifactory CVE under attack by AI agents or humans The Register · News · 2026-09-01
• Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild SecurityWeek · News · 2026-09-01
• JFrog Artifactory flaw exploited days after patch release scworld.com · News · 2026-09-01
• JFrog Artifactory Auth Bypass Exploited in Attacks to Gain Admin Access cybersecuritynews.com · News · 2026-09-01

Threats related to JFrog phantom join key

• OpenAI Models Chain Eight JFrog Artifactory Zero-Days to Escape Sandbox and Breach Hugging Face
• AI Agents Persist Through Failed Malware, Rewrite Tools Mid-Attack: SentinelLABS Documents Sandbox Escape, PyPI Supply-Chain Package, and Artifactory Zero-Day Abuse

Previous and next in vulnerability

• CVE-2026-0768: Critical Langflow RCE Vulnerability Under Active Exploitation Previous report
• Active Exploitation of Sangoma Switchvox Unauthenticated SQL Injection (CVE-2026-9586) Deploying Reverse Shells Next report