{"id":2636,"date":"2026-09-01T19:03:12","date_gmt":"2026-09-01T19:03:12","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2636"},"modified":"2026-09-01T19:03:12","modified_gmt":"2026-09-01T19:03:12","slug":"attackers-exploit-critical-jfrog-artifactory-flaw-to-mint-admin-tokens-days-after-disclosure","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2636","title":{"rendered":"Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Sep 01, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Supply Chain Attack<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg0o8dDcHW4CJBLnXfYzfofbG1w0Fi4zCPqcjEgASsL0gXnESv5isMONZgXzek2rM3VwkhnEqz2K4whDwB_lFylCYvfXASQmsQSPA-8U25998PBT2Xopdaaj9_iG0XqdBPu6iXRmtlN2CGc8b5mv3t68CVxV2HYneRkiUhUu3EIgSogEgipzJUiymLfl0NQ\/s1700-nu-rw-lo-l85-e365\/jfrog.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to <a href=\"https:\/\/x.com\/watchtowrcyber\/status\/2094639075726668267\" target=\"_blank\">watchTowr<\/a>.<\/p>\n<p>The vulnerability in question is <strong><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-82329\" target=\"_blank\">CVE-2026-82329<\/a><\/strong> (CVSS score: 9.8), a case of authentication bypass that could lead to administrative access in Artifactory.<\/p>\n<p>\u00abJFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges,\u00bb according to a description of the flaw on CVE.org.<\/p>\n<p>The vulnerability was patched by JFrog with <a href=\"https:\/\/docs.jfrog.com\/releases\/docs\/artifactory-self-managed-releases\" target=\"_blank\">Artifactory version 7.161.20<\/a> released on August 28, 2026. It <a href=\"https:\/\/docs.jfrog.com\/releases\/docs\/jfrog-security-advisories\" target=\"_blank\">affects<\/a> the following versions &#8211;<\/p>\n<ul>\n<li>7.161.0 &gt; 7.161.19<\/li>\n<li>7.146.0 &gt; 7.146.36<\/li>\n<li>7.133.0 &gt; 7.133.28<\/li>\n<li>7.125.0 &gt; 7.125.19<\/li>\n<li>7.117.0 &gt; 7.117.27<\/li>\n<li>7.111.4 &gt; 7.111.21<\/li>\n<\/ul>\n<p>\u00abIt affects default configs, requires no auth, no user interaction,\u00bb Vercel CEO Guillermo Rauch <a href=\"https:\/\/www.linkedin.com\/posts\/rauchg_two-days-ago-jfrog-dropped-cve-2026-82329-activity-7499907121031991297-QVfg\/\" target=\"_blank\">said<\/a> in a post on LinkedIn. \u00abIt&#8217;s an RCE bomb because Artifactory hosts binaries, so you can basically poison everything, but an admin escalation can cause damage even beyond that.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/enterprise-ai-security-a\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhgJrVTpy3T5kJ7VEIro3XfMOmfqDnBU03fYT5CyFWrs2rE9BeQxs835FAS_f1yivzd7mZ7KartftPk4qs8w5Br-WzfYMXruXDQk4FiuXcvSxoA4XH93ipwJJyy2Hbs9jqs-keS9KZhCnQ2YYdv93M51kxJlE862ob-RrrEhP4DEVP3E79zMMPf43e5keoK\/s728-nu-rw-lo-l85-e365\/AI-eBook-d-2.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The issue resides in JFrog Access, which is designed to issue and validate credentials. \u00abInstances without an additional join key configured receive a &#8216;phantom&#8217; join key that attackers can abuse to forge access and mint administrator-level credentials,\u00bb Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement shared with The Hacker News.<\/p>\n<p>Ganchev also pointed out that threat actors have begun to weaponize the flaw as of September 1, 2026, to generate admin tokens and enumerate users, groups, credential sets and federated access topologies.<\/p>\n<p>\u00abThis moved from disclosure to real-world exploitation with uncomfortable efficiency,\u00bb Ganchev added. \u00abAnyone following along knows what comes next: things will get worse.\u00bb<\/p>\n<p>\u00abWhen attackers gain admin level access to a central software supply chain system, they can do what every engineering team does best \u2013 build, ship and distribute software fast. From there, they could tamper with build pipelines, move laterally into production systems and potentially push malicious changes downstream to customers.\u00bb<\/p>\n<p>Organizations that are running self-managed versions of JFrog Artifactory are recommended to apply patches to internet-exposed systems with immediate effect, as well as inspect audit logs, rotate exposed credentials, and review connected systems for malicious changes or backdoor access.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Sep 01, 2026Vulnerability \/ Supply Chain Attack Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr. The&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2637,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[129,2761,622,58,1685,799,120,70,2760,3258,146],"class_list":["post-2636","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-admin","tag-artifactory","tag-attackers","tag-critical","tag-days","tag-disclosure","tag-exploit","tag-flaw","tag-jfrog","tag-mint","tag-tokens"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2636"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2636\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2637"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}