# CVE-2026-82329: Critical JFrog Artifactory Authentication Bypass Exploited Days After Disclosure

> A critical authentication weakness in JFrog Artifactory (CVE-2026-82329, CVSS 9.8) lets an unauthenticated network attacker obtain administrative privileges on default-configured, self-managed instances by abusing an implicit 'phantom' join key issued by the JFrog Access subsystem when no explicit join key is configured. watchTowr's Attacker Eye honeypot network observed active exploitation on internet-exposed systems on Aug. 31, 2026 — three days after JFrog's Aug. 28 disclosure and patch release — with attackers minting forged admin tokens and enumerating users, groups, credential sets, and federated access topologies; a public proof-of-concept from Pruva and ethical hacker Souhaib Naceri followed, raising the risk of broader exploitation.

- **Published:** 2026-09-01T00:00:00Z
- **Last reviewed:** 2026-11-02T16:02:18.644Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2287
- **ID:** TL-2026-2287
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 33 (3 shown free below)
- **CVEs:** CVE-2026-82329

## Description

CVE-2026-82329 is a CWE-287 (Improper Authentication) flaw in JFrog Artifactory's JFrog Access identity and token-issuance subsystem. Under Artifactory's default configuration, self-managed instances that have not had an additional, explicit join key configured are issued an implicit 'phantom' join key by JFrog Access. Because this phantom key is predictable/derivable rather than a genuine per-instance secret, an unauthenticated attacker with network access to the instance can abuse it to forge trust material and mint administrator-level access tokens without ever presenting valid credentials. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — no authentication, no privileges, and no user interaction are required, and successful exploitation yields full confidentiality, integrity, and availability impact.

JFrog disclosed the vulnerability and shipped patched builds across all six affected 7.x self-managed release branches on Aug. 28, 2026; JFrog Artifactory Cloud (SaaS) customers were already patched automatically and required no action. Three days later, on Aug. 31, 2026, watchTowr's global Attacker Eye honeypot network reported observing real-world exploitation attempts against CVE-2026-82329: attackers used the phantom-join-key forgery technique to mint themselves valid administrator tokens, then used those tokens to enumerate user accounts, permission groups, stored credential sets, and federated repository/access topologies — reconnaissance that maps directly to the blast radius an attacker would need to understand before pivoting into build pipelines or exfiltrating secrets. watchTowr characterized the observed activity as originating from a small number of IP addresses spread across varying geographies and attributed to multiple distinct threat actors, with broad mass-scanning not yet observed but considered likely to follow.

Shortly after watchTowr's report, security researchers at Pruva, working with ethical hacker Souhaib Naceri, published a proof-of-concept exploit for CVE-2026-82329 and reported readily reproducing the phantom-join-key forgery, further lowering the barrier to mass exploitation. Because Artifactory sits at the center of software build and release pipelines for a large share of enterprise DevOps environments — JFrog reports serving a majority of the Fortune 100 and a broad customer base spanning technology, financial services, healthcare, retail, and government — an attacker who obtains administrator access to a self-managed instance gains control over repositories, stored credentials, build artifacts, and federated replication relationships, with a realistic path to tampering with or substituting malicious software packages and thereby compromising the downstream software supply chain. Given the confirmed active exploitation, the low complexity of the attack, and the now-public PoC, JFrog Artifactory administrators who have not yet upgraded should treat any unpatched, internet-exposed self-managed instance as potentially already compromised.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1606 Forge Web Credentials
- T1552 Unsecured Credentials
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1018 Remote System Discovery
- T1213 Data from Information Repositories
- T1136 Create Account
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**JFrog Artifactory Admin Token Minted via Phantom Join Key (CVE-2026-82329) — SPL** (`TL-2026-2287-SPL-001`)

Detects an administrator-scoped Artifactory access token issued by the JFrog Access subsystem with no preceding authenticated actor session — the phantom-join-key forgery mechanic underlying CVE-2026-82329, where a self-managed instance without an explicit configured join key issues an implicit/predictable key that an unauthenticated network attacker can abuse to forge trust material and mint admin tokens directly.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1606, T1552
- **Data sources:** jfrog_access_audit_log, jfrog_artifactory_request_log, network_proxy_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=jfrog sourcetype="jfrog:access:audit" event_type="CREATE_TOKEN"
| eval is_admin_scope=if(match(token_scope, "(?i)admin"), 1, 0)
| where is_admin_scope=1
| where auth_method="join_key" OR auth_method="anonymous" OR isnull(actor) OR actor=""
| stats count min(_time) as first_seen max(_time) as last_seen values(client_ip) as client_ips values(token_scope) as scopes by instance_id
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| eval alert="Admin-scope token minted via phantom/implicit join key with no authenticated actor"
| table instance_id first_seen last_seen client_ips scopes count alert
```

### Microsoft KQL

```kql
JFrogAccessLogs_CL
| where TimeGenerated > ago(24h)
| where EventType_s == "CREATE_TOKEN"
| where TokenScope_s has "admin"
| where AuthMethod_s in ("join_key", "anonymous", "") or isempty(Actor_s)
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ClientIPs=make_set(ClientIP_s), Scopes=make_set(TokenScope_s) by InstanceId_s
| project InstanceId_s, Count, FirstSeen, LastSeen, ClientIPs, Scopes
```

### Sigma

```yaml
title: JFrog Artifactory Admin Token Minted via Phantom Join Key (CVE-2026-82329)
id: a1e4c2d0-6f3b-4c8e-9a21-7d3f5b6e1001
status: experimental
description: Detects an administrator-scoped Artifactory access token issued by the JFrog Access subsystem without a preceding authenticated actor session, consistent with phantom-join-key forgery abuse of CVE-2026-82329.
references:
    - https://docs.jfrog.com/releases/docs/jfrog-security-advisories
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-82329
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-01
tags:
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1606
    - attack.t1552
    - cve.2026.82329
logsource:
    category: application
    product: jfrog
    service: access
detection:
    selection:
        EventType: 'CREATE_TOKEN'
        TokenScope|contains: 'admin'
    filter_authenticated:
        AuthMethod:
            - 'join_key'
            - 'anonymous'
    condition: selection and filter_authenticated
falsepositives:
    - Legitimate first-time instance bootstrap issuing an initial admin token via join key
    - Automation/CI service accounts intentionally configured for join-key-based token issuance
level: critical
```

**Known false positives:**

- Legitimate first-time instance bootstrap issuing an initial admin token via join key before an explicit key is configured
- Automation or CI service accounts intentionally configured to authenticate via join-key-based token issuance

**Tuning notes:** Baseline known automation/CI accounts and their expected join-key token issuance windows, then suppress the documented first-run bootstrap event; alert only on admin-scope token creations occurring after initial setup, and cross-check `instance_id` against the patched-version inventory (7.111.21/7.117.28/7.125.20/7.133.29/7.146.38/7.161.20) to suppress already-remediated hosts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- JFrog Artifactory Admin Token Minted via Phantom Join Key (CVE-2026-82329) — KQL (locked: unlock with TL Creds)
- Forged-Admin-Token Mass Enumeration of Users, Groups, and Federated Repositories — KQL (locked: unlock with TL Creds)
- Federated Replication Reconfiguration Shortly After Forged Admin-Token Mint (Supply-Chain Pivot) — KQL (locked: unlock with TL Creds)
- JFrog Artifactory Admin Token Minted via Phantom Join Key (CVE-2026-82329) — Sigma (locked: unlock with TL Creds)
- Forged-Admin-Token Mass Enumeration of Users, Groups, and Federated Repositories — Sigma (locked: unlock with TL Creds)
- Federated Replication Reconfiguration Shortly After Forged Admin-Token Mint (Supply-Chain Pivot) — Sigma (locked: unlock with TL Creds)
- Forged-Admin-Token Mass Enumeration of Users, Groups, and Federated Repositories — SPL (locked: unlock with TL Creds)
- Federated Replication Reconfiguration Shortly After Forged Admin-Token Mint (Supply-Chain Pivot) — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 33)

Defanged, TLP:CLEAR.

- IP address: `213.136.72[.]87`
- File hash: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
- IP address: `89.117.49[.]147`

Full set of 33 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Attackers Jump on Critical Artifactory Flaw After Disclosure](https://www.darkreading.com/application-security/attackers-pounce-critical-artifactory-flaw-disclosure)
- [Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens](https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html)
- [Another Artifactory CVE under attack by AI agents or humans](https://www.theregister.com/security/2026/09/01/another-artifactory-cve-under-attack-by-ai-agents-or-humans/5293769)
- [Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild](https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/)
- [JFrog Artifactory flaw exploited days after patch release](https://www.scworld.com/news/jfrog-artifactory-flaw-exploited-days-after-patch-release)
- [JFrog Artifactory Auth Bypass Exploited in Attacks to Gain Admin Access](https://cybersecuritynews.com/jfrog-artifactory-auth-bypass-exploited/)
- [JFrog Security Advisories](https://docs.jfrog.com/releases/docs/jfrog-security-advisories)
- [NVD - CVE-2026-82329 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-82329)
- [Rapid7 Vulnerability & Exploit Database - CVE-2026-82329](https://www.rapid7.com/db/vulnerabilities/cve-2026-82329/)
- [IONIX Threat Center - CVE-2026-82329](https://www.ionix.io/threat-center/cve-2026-82329/)
- [watchTowr Intel on X: active exploitation of CVE-2026-82329](https://x.com/watchtowrcyber/status/2094639075726668267)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2287