{"id":"CVE-2026-82329","kind":"vulnerability","aliases":["CVE-2026-82329"],"related":[],"title":"JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an…","description":"WAF Release - 2026-09-25 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nSeptember 25, 2026\n\n## WAF Release - 2026-09-25 - Emergency\n\nThis update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits.\n\nKey Findings\n\n- CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files.\n- CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance.\n\nImpact\n\nWe strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers.\n\nDetailed Rule Changes\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...70a43f96 | N/A | Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...909a4db4 | N/A | Wordpress - XSS - Comment | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c797ef03 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a813ac74 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 | N/A | Block | This is a new detection. |","summary":"Unauthenticated auth bypass in the JFrog Access service of self-hosted Artifactory, default config. An empty join key is trusted, so anyone can forge a join JWT (kid = SHA256 of empty string) and POST /access/api/v1/registry/join to get an admin token. JFrog Cloud was patched by JFrog. Mass exploitation and a public PoC exist. Attackers create admin accounts, drop Groovy plugins and Rust backdoors that survive patching.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-09-02T00:00:00+00:00","products":[{"name":"JFrog Artifactory","fixed":["7.111.21","7.117.28","7.125.20","7.133.29","7.146.38","7.161.20"],"affected":"< 7.111.21; >= 7.117.0, < 7.117.28; >= 7.125.0, < 7.125.20; >= 7.133.0, < 7.133.29; >= 7.146.0, < 7.146.38; >= 7.161.0, < 7.161.20","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.111.21"],"affected":">= 7.111.4, < 7.111.21","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.117.28"],"affected":">= 7.117.0, < 7.117.28","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.125.20"],"affected":">= 7.125.0, < 7.125.20","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.133.29"],"affected":">= 7.133.0, < 7.133.29","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.146.38"],"affected":">= 7.146.0, < 7.146.38","ecosystem":"vendor"},{"name":"jfrog artifactory","fixed":["7.161.20"],"affected":">= 7.161.0, < 7.161.20","ecosystem":"vendor"},{"name":"JFrog Artifactory","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["artifactory","ci-cd","cloudflare","exploited","jfrog","jfrog-cloud","lab-disclosure","package","self-hosted"],"not_affected_if":["jfrog-cloud","patched-version","unknown"],"how_to_check":"Check version: self-hosted Artifactory below 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 (per branch) is vulnerable. Hunt logs for POST /access/api/v1/registry/join (also /join/router) with HTTP 200/201 and JWT kid e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855; a 201 is a likely compromise. Review admin users (PUT /api/security/users, customData.artifactory_admin, names like Nxploited_*, labadmin_, 0xTerror, svc_*, jfrog-insight, repo-service), tokens minted since 28 Aug, and unexpected Groovy files in $JFROG_HOME/var/etc/artifactory/plugins/.","fix":"Upgrade to the fixed build for your branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 (or later). Workaround if you cannot upgrade: set shared.security.additionalJoinKeys in system.yaml to a random hex value (openssl rand -hex 16), keeping the existing joinKey, and restart Access. For Helm/containers use JF_SHARED_SECURITY_ADDITIONALJOINKEYS. After patching, rotate the join key, revoke tokens issued since 28 Aug, remove rogue admins and plugins, and rotate stored upstream and LDAP credentials if exposed.","status":"resolved","published_at":"2026-08-28T20:20:21+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:42+00:00","updated_at":"2026-10-24T17:31:12+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T20:31:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch per JFrog's advisory; the sources do not name a fixed version. If no mitigation is available, discontinue use of the product per CISA guidance.","summary":"JFrog Artifactory has an authentication flaw that, under default configuration, lets an unauthenticated attacker with network access gain administrative privileges. CISA lists it as actively exploited in the wild.","category":"package","who_cares":["artifactory","self-hosted","jfrog-cloud","ci-cd"],"confidence":0.6,"analyst_note":"Find the JFrog advisory for CVE-2026-82329 for affected and fixed versions and a concrete check (e.g. admin-account or config indicators); the KEV entry alone gives neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"severity_if_unknown":"critical"},"cost_usd":0.000374,"input_tokens":2196,"output_tokens":309,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the JFrog advisory for CVE-2026-82329 for affected and fixed versions and a concrete check (e.g. admin-account or config indicators); the KEV entry alone gives neither.","search":"'-09':122C,139C '-2026':14A,17A,174C,213C,216C,291C,326C,346C '-25':123C,140C '-42018':214C,327C '-82329':15A,18A,217C,347C '-87902':175C,292C '/access/api/v1/registry/join':87B '2026':121C,135C,138C '25':134C '70a43f96':281C '909a4db4':303C 'a813ac74':338C 'access':58B,237C 'account':109B 'achiev':235C 'action':274C,276C 'admin':91B,108B 'administr':247C 'affect':150C,188C,222C 'allow':12A,227C 'anyon':74B 'appli':248C 'arbitrari':198C 'artifactori':2A,35B,64B,154C,224C,240C,257C,321C,341C 'artifactory':20A,22A,24A,26A,28A,30A,32A,34A 'attack':106B,191C,229C 'auth':53B 'authent':5A,168C,219C,322C,342C 'backdoor':115B 'block':294C,309C,329C,349C 'bypass':54B,169C,220C,231C,323C,343C 'c797ef03':318C 'cd':38B 'chang':265C 'changelog':125C,126C 'ci':37B 'ci-cd':36B 'cloud':44B,94B 'cloudflar':39B,132C,278C,300C,315C,335C 'comment':277C,307C 'config':66B 'configur':10A,207C 'contain':3A 'control':233C 'creat':107B 'critic':148C,218C 'cross':163C 'cross-sit':162C 'cve':13A,16A,173C,212C,215C,289C,290C,324C,325C,344C,345C 'data':208C 'default':9A,65B 'defens':146C 'descript':272C 'detail':263C 'detect':299C,314C,334C,354C 'disclosur':47B 'drop':110B 'emerg':124C,141C 'empti':68B,83B 'exist':105B 'exploit':40B,100B,170C,193C,226C 'expos':205C 'file':159C,184C,199C,211C,287C 'find':172C 'flaw':195C 'forg':76B 'fulli':259C 'get':89B 'groovi':111B 'high':178C 'high-sever':177C 'host':51B,63B,202C 'id':268C,271C 'immedi':145C 'impact':242C 'improv':130C 'includ':155C 'inclus':160C,185C,288C 'instanc':241C 'jfrog':1A,19A,21A,23A,25A,27A,29A,31A,33A,41B,43B,57B,93B,98B,153C,223C,256C,320C,340C 'jfrog-cloud':42B 'join':69B,78B 'jwt':79B 'key':70B,171C 'kid':80B 'lab':46B 'lab-disclosur':45B 'latest':250C 'legaci':269C 'lfi':161C,186C 'local':158C,183C,286C 'manag':279C,301C,316C,336C 'mass':99B 'may':11A 'n/a':282C,293C,304C,308C,319C,328C,339C,348C 'new':127C,275C,298C,313C,333C,353C 'origin':261C 'packag':48B 'patch':96B,118B,252C 'path':156C,180C,284C 'plugin':112B 'poc':104B 'post':86B 'potenti':204C 'previous':273C 'provid':144C 'public':103B 'read':197C 'recommend':245C 'releas':120C,137C 'rule':264C,267C,270C 'ruleset':266C,280C,302C,317C,337C 'rust':114B 'script':165C 'secur':232C,260C 'self':50B,62B 'self-host':49B,61B 'sensit':206C 'septemb':133C 'server':203C,262C 'servic':59B 'sever':179C 'sha256':81B 'site':164C 'string':84B 'strong':244C 'success':225C 'surviv':117B 'system':210C 'token':92B 'travers':157C,181C,285C 'trust':72B 'unauthent':52B,190C,228C 'unauthor':236C 'updat':128C,143C 'vendor':251C 'vulner':149C,187C,221C 'waf':119C,136C 'weak':6A 'wordpress':151C,189C,254C,283C,305C 'xss':166C,306C","nicknames":[],"mitigations":[{"kind":"waf-rule","since":"2026-09-25","covers":"HTTP requests proxied through Cloudflare matching the JFrog Artifactory authentication bypass rule for CVE-2026-82329 (Cloudflare Managed Ruleset rule ...a813ac74)","limits":"Traffic not proxied through Cloudflare; origin servers reachable directly; non-HTTP paths","source":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:12Z","confidence":0.9,"source_title":"Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog","customer_action":"Apply the latest JFrog Artifactory vendor patch to fully secure origin servers, as Cloudflare recommends"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-28T20:20:21+00:00","kev":{"dateAdded":"2026-09-02","dueDate":"2026-09-05","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"reefs@jfrog.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-82329","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329","severity":null,"published_at":"2026-09-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-82329:92","url":null,"severity":null,"published_at":"2026-10-23T21:30:47+00:00","modified_at":"2026-10-23T21:30:47+00:00","first_seen_at":"2026-10-23T21:30:47+00:00","fetched_at":"2026-10-23T21:30:47+00:00","note":"JFrog advisory (28 Aug 2026) table lists branches; its upper bounds are one patch lower than CVE record/Fastly/Wiz/CCCS fixed builds (e.g. 7.161.19 vs 7.161.20) - used CVE record fixed versions. Exploited since ~1 Sep, public PoC, CISA KEV 2 Sep. Fastly/Wiz give IOCs. Did not search social posts."},{"source":"nvd","external_id":"CVE-2026-82329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82329","severity":null,"published_at":"2026-08-28T20:20:21+00:00","modified_at":"2026-09-03T13:06:15+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/#CVE-2026-82329","url":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/","severity":null,"published_at":"2026-09-25T17:18:07+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog"}],"documents":[{"id":1051,"url":"https://docs.jfrog.com/releases/docs/jfrog-security-advisories","title":"JFrog Security Advisories (CVE-2026-66384: <7.146.35; 7.161.0-7.161.16)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1052,"url":"https://www.fastly.com/blog/cve-2026-82329-jfrog-artifactory-authentication-bypass-exploitation-activity","title":"Fastly: CVE-2026-82329 exploitation activity","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1054,"url":"https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201","title":"Wiz: Artifactory Under Attack (in-the-wild exploitation)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1056,"url":"https://www.wiz.io/vulnerability-database/cve/cve-2026-82329","title":"Wiz vuln DB: CVE-2026-82329 mitigation","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1060,"url":"https://www.cve.org/CVERecord?id=CVE-2026-82329","title":"CVE Record CVE-2026-82329 (CNA: JFrog)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2845,"url":"https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/","title":"Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-09-25 - Emergency · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nSeptember 25, 2026\n\n## WAF Release - 2026-09-25 - Emergency\n\nThis update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits.\n\nKey Findings\n\n- CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files.\n- CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance.\n\nImpact\n\nWe strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers.\n\nDetailed Rule Changes\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...70a43f96 | N/A | Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...909a4db4 | N/A | Wordpress - XSS - Comment | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c797ef03 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a813ac74 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 | N/A | Block | This is a new detection. |","published_at":"2026-09-25T17:18:07+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}