Artifactory’s Default Configuration Could Give an Unauthenticated Attacker Admin Access.
JFrog has fixed a critical Artifactory authentication weakness that can give a remote unauthenticated attacker administrative privileges under the product’s default configuration. Cloud environments have been hardened, but self-hosted customers must upgrade.
The vulnerability, CVE-2026-82329, was published on 28 August 2026. JFrog classifies it as critical and describes the weakness as improper authentication. The vendor has not disclosed the vulnerable endpoint, exploit sequence or a workaround.
That limited technical detail should not be mistaken for limited impact. Artifactory often holds proprietary packages, build inputs, deployment artifacts, signing-related material and credentials used by CI/CD systems. Administrative access can therefore reach far beyond one repository service.
Update, 2 September 2026: attackers are creating administrator tokens
The exposure has moved from a critical vendor warning to reported exploitation. WatchTowr says telemetry from its Attacker Eye honeypot network shows attackers using CVE-2026-82329 to create administrator tokens and enumerate users, groups, credential sets and federated-access relationships. Canada’s Cyber Centre has separately warned that open-source reporting indicates exploitation in the wild.
CISA has now added CVE-2026-82329 to its Known Exploited Vulnerabilities catalogue. Federal civilian agencies have until 5 September 2026 to remediate it. The catalogue lists ransomware use as unknown and provides no campaign details. This moves the status from credible reported exploitation to formal CISA confirmation. The entry was added on 2 September 2026, and the catalogue provides a date but no publication time.
JFrog has not publicly confirmed the activity, and the available reporting does not establish its scale or show that attackers altered artifacts. The observed actions are nevertheless material. An administrator token can survive the original request, while the enumeration reveals how Artifactory connects to identities, build systems and other trusted services. Self-hosted operators should patch immediately, review all privileged accounts and tokens, investigate access to credential and federation settings, validate recently published artifacts against an independent source of truth, and rotate CI/CD or deployment credentials if compromise is plausible.
- SecurityWeek, Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild, published 1 September 2026 at 05:59 ET and updated 2 September 2026 at 01:00 ET.
- Canadian Centre for Cyber Security advisory AV26-867, published 1 September 2026. No publication time was provided.
Update, 29 August 2026: CISA confirms exploitation of a second Artifactory flaw
CISA has added a different Artifactory vulnerability, CVE-2026-66384, to its Known Exploited Vulnerabilities catalogue. The entry was added on 27 August with a remediation deadline of 10 September 2026. CISA has confirmed exploitation, but has not published campaign details and lists ransomware use as unknown.
This is not the unauthenticated administrative bypass described above. JFrog rates CVE-2026-66384 medium severity. Under specific remote Docker repository conditions, an authenticated user can traverse outside the intended cache path and write data elsewhere on the Artifactory server. The weakness affects versions before 7.146.35 and versions from 7.161.0 through 7.161.15. JFrog fixed it in 7.146.35 and 7.161.16.
The operational lesson is that severity scores and exploitation status answer different questions. CVE-2026-82329 exposes the more severe unauthenticated boundary, while CVE-2026-66384 is the flaw CISA says attackers are already using. Self-hosted customers should verify that their upgrade path covers both issues rather than assuming the newest advisory supersedes the older fix.
Default configuration is the warning
The phrase that changes defender urgency is “under default configuration.” The attacker needs network access to the affected service, but no account. JFrog says successful exploitation may result in administrative privileges.
JFrog has already fortified affected cloud environments. The remaining operational burden falls on self-hosted deployments, including internal instances that may still be reachable through VPNs, partner networks, build runners or compromised developer systems.
Affected and fixed Artifactory versions
| Release branch | Affected versions | Patched version |
|---|---|---|
| 7.161 | 7.161.0 through 7.161.19 | 7.161.20 |
| 7.146 | 7.146.0 through 7.146.36 | 7.146.38 |
| 7.133 | 7.133.0 through 7.133.28 | 7.133.29 |
| 7.125 | 7.125.0 through 7.125.19 | 7.125.20 |
| 7.117 | 7.117.0 through 7.117.27 | 7.117.28 |
| 7.111 | 7.111.4 through versions before 7.111.21 | 7.111.21 |
JFrog’s summary table contains compact range notation that can be easy to misread. Administrators should compare their full build number with the patched version in the right-hand column. The vendor’s remediation list names 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20.
Four more Artifactory advisories landed in the same week
| Vulnerability | Impact and prerequisite | Fixed versions | Exploitation and PoC status |
|---|---|---|---|
| CVE-2026-70551 High | A user able to read an existing remote VCS repository can replace its origin or supply an absolute VCS data URL, causing server-side requests. | 7.161.19 and 7.146.36 | No confirmed exploitation or public PoC identified. |
| CVE-2026-70550 Medium | An authenticated user can read private Composer package metadata from a repository they are not authorised to read under specific conditions. | 7.161.19 and 7.146.36 | No confirmed exploitation or public PoC identified. |
| CVE-2026-70548 Low | A low-privileged user can cause requests to remote CocoaPods repositories through External Dependency handling under specific conditions. | 7.161.19 and 7.146.36 | No confirmed exploitation or public PoC identified. |
| CVE-2026-69104 High | An authenticated user can initiate repository migration without the required repository permission, potentially exposing information, changing state or disrupting service. | 7.161.19 | No confirmed exploitation or public PoC identified. |
The four 25 August advisories have narrower prerequisites than the critical bypass. They still matter for exposed or multi-tenant repository environments, but they should not distract from patching CVE-2026-82329 first.
What defenders should do now
- Inventory self-hosted Artifactory. Include disaster-recovery nodes, build-lab systems and partner-managed environments.
- Upgrade to the fixed build for the installed branch. Do not infer safety from a major or minor release label.
- Reduce network reachability. Limit administration and repository interfaces to expected users, build systems and management networks.
- Review administrator activity. Hunt for newly created privileged users, token changes, repository permission changes, unexpected remote repositories and unexplained configuration exports.
- Protect the software supply chain. Rotate exposed CI/CD credentials, signing keys or deployment tokens if compromise is suspected, and validate recently promoted artifacts.
The BlackTree view
An artifact repository is not just storage. It is a trust broker between developers, build systems and production. A default-config authentication bypass that grants administrative access threatens both the repository and every downstream system that trusts what comes out of it.
WatchTowr has reported active exploitation of CVE-2026-82329, including administrator-token creation and environment enumeration. JFrog has not publicly confirmed that activity, and a public proof of concept was not identified in the reviewed sources. CISA has separately confirmed exploitation of the authenticated path-traversal flaw CVE-2026-66384. Defenders should patch both attack paths and preserve the distinction when assessing exposure.
Sources
- JFrog Security Advisories, CVE-2026-82329 published and updated 28 August 2026. The vendor provides no publication time.
- JFrog advisory for CVE-2026-70551, published 25 August 2026. No publication time was provided.
- JFrog advisory for CVE-2026-70550, published 25 August 2026. No publication time was provided.
- JFrog advisory for CVE-2026-70548, published 25 August 2026. No publication time was provided.
- JFrog advisory for CVE-2026-69104, published 25 August 2026. No publication time was provided.
- CISA Known Exploited Vulnerabilities catalogue, CVE-2026-66384 added 27 August 2026 with remediation due 10 September 2026. The catalogue provides dates but no publication time.
- JFrog advisory for CVE-2026-66384, initially published and updated 12 August 2026. The vendor provides no publication time.
- NVD vulnerability record for CVE-2026-66384, published 12 August 2026 at 12:17:14 UTC.
