--- id: "CVE-2026-82329" kind: "vulnerability" aliases: ["CVE-2026-82329"] title: "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "resolved" category: "package" products: [{"name": "JFrog Artifactory", "fixed": ["7.111.21", "7.117.28", "7.125.20", "7.133.29", "7.146.38", "7.161.20"], "affected": "< 7.111.21; >= 7.117.0, < 7.117.28; >= 7.125.0, < 7.125.20; >= 7.133.0, < 7.133.29; >= 7.146.0, < 7.146.38; >= 7.161.0, < 7.161.20", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.111.21"], "affected": ">= 7.111.4, < 7.111.21", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.117.28"], "affected": ">= 7.117.0, < 7.117.28", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.125.20"], "affected": ">= 7.125.0, < 7.125.20", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.133.29"], "affected": ">= 7.133.0, < 7.133.29", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.146.38"], "affected": ">= 7.146.0, < 7.146.38", "ecosystem": "vendor"}, {"name": "jfrog artifactory", "fixed": ["7.161.20"], "affected": ">= 7.161.0, < 7.161.20", "ecosystem": "vendor"}, {"name": "JFrog Artifactory", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["artifactory", "ci-cd", "cloudflare", "exploited", "jfrog", "jfrog-cloud", "lab-disclosure", "package", "self-hosted"] not_affected_if: ["jfrog-cloud", "patched-version", "unknown"] published_at: "2026-08-28T20:20:21+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T17:31:12+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:30:47+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82329", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/", "first_seen_at": "2026-10-24T17:18:15+00:00"}] --- # JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an… Unauthenticated auth bypass in the JFrog Access service of self-hosted Artifactory, default config. An empty join key is trusted, so anyone can forge a join JWT (kid = SHA256 of empty string) and POST /access/api/v1/registry/join to get an admin token. JFrog Cloud was patched by JFrog. Mass exploitation and a public PoC exist. Attackers create admin accounts, drop Groovy plugins and Rust backdoors that survive patching. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:JFrog Artifactory affected < 7.111.21; >= 7.117.0, < 7.117.28; >= 7.125.0, < 7.125.20; >= 7.133.0, < 7.133.29; >= 7.146.0, < 7.146.38; >= 7.161.0, < 7.161.20 fixed 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 - vendor:jfrog artifactory affected >= 7.111.4, < 7.111.21 fixed 7.111.21 - vendor:jfrog artifactory affected >= 7.117.0, < 7.117.28 fixed 7.117.28 - vendor:jfrog artifactory affected >= 7.125.0, < 7.125.20 fixed 7.125.20 - vendor:jfrog artifactory affected >= 7.133.0, < 7.133.29 fixed 7.133.29 - vendor:jfrog artifactory affected >= 7.146.0, < 7.146.38 fixed 7.146.38 - vendor:jfrog artifactory affected >= 7.161.0, < 7.161.20 fixed 7.161.20 - vendor:JFrog Artifactory affected ? fixed ? ## How to check Check version: self-hosted Artifactory below 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 (per branch) is vulnerable. Hunt logs for POST /access/api/v1/registry/join (also /join/router) with HTTP 200/201 and JWT kid e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855; a 201 is a likely compromise. Review admin users (PUT /api/security/users, customData.artifactory_admin, names like Nxploited_*, labadmin_, 0xTerror, svc_*, jfrog-insight, repo-service), tokens minted since 28 Aug, and unexpected Groovy files in $JFROG_HOME/var/etc/artifactory/plugins/. ## Fix Upgrade to the fixed build for your branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 (or later). Workaround if you cannot upgrade: set shared.security.additionalJoinKeys in system.yaml to a random hex value (openssl rand -hex 16), keeping the existing joinKey, and restart Access. For Helm/containers use JF_SHARED_SECURITY_ADDITIONALJOINKEYS. After patching, rotate the join key, revoke tokens issued since 28 Aug, remove rogue admins and plugins, and rotate stored upstream and LDAP credentials if exposed. ## Mitigated for you by - Cloudflare (waf-rule, since 2026-09-25): covers HTTP requests proxied through Cloudflare matching the JFrog Artifactory authentication bypass rule for CVE-2026-82329 (Cloudflare Managed Ruleset rule ...a813ac74) Limits: Traffic not proxied through Cloudflare; origin servers reachable directly; non-HTTP paths Still: Apply the latest JFrog Artifactory vendor patch to fully secure origin servers, as Cloudflare recommends https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/ ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329 - 2026-10-23T21:30:47+00:00 analyst — JFrog advisory (28 Aug 2026) table lists branches; its upper bounds are one patch lower than CVE record/Fastly/Wiz/CCCS fixed builds (e.g. 7.161.19 vs 7.161.20) - used CVE record fixed versions. Exploited since ~1 Sep, public PoC, CISA KEV 2 Sep. Fastly/Wiz give IOCs. Did not search social posts. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82329 - 2026-10-24T17:18:15+00:00 lab https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/ — Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog ## Documents - [advisory] JFrog Security Advisories (CVE-2026-66384: <7.146.35; 7.161.0-7.161.16) https://docs.jfrog.com/releases/docs/jfrog-security-advisories - [advisory] CVE Record CVE-2026-82329 (CNA: JFrog) https://www.cve.org/CVERecord?id=CVE-2026-82329 - [advisory] Cloudflare: WAF Release - 2026-09-25 - Emergency · Changelog https://developers.cloudflare.com/changelog/post/2026-09-25-emergency-waf-release/ - [describes] Fastly: CVE-2026-82329 exploitation activity https://www.fastly.com/blog/cve-2026-82329-jfrog-artifactory-authentication-bypass-exploitation-activity - [describes] Wiz: Artifactory Under Attack (in-the-wild exploitation) https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 - [mitigation] Wiz vuln DB: CVE-2026-82329 mitigation https://www.wiz.io/vulnerability-database/cve/cve-2026-82329 ## From the sources WAF Release - 2026-09-25 - Emergency · Changelog # Changelog New updates and improvements at Cloudflare. September 25, 2026 ## WAF Release - 2026-09-25 - Emergency This update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits. Key Findings - CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files. - CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance. Impact We strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers. Detailed Rule Changes | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | --- | --- | --- | --- | --- | --- | --- | | Cloudflare Managed Ruleset | ...70a43f96 | N/A | Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902 | N/A | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...909a4db4 | N/A | Wordpress - XSS - Comment | N/A | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...c797ef03 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018 | N/A | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...a813ac74 | N/A | JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329 | N/A | Block | This is a new detection. | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_