#CVE-2026-82329

Critical JFrog Artifactory Authentication Bypass Seeing Active Exploitation to Mint Admin Tokens

JFrog Artifactory is actively dealing with critical security fallout as attackers have begun exploiting a freshly disclosed flaw in the wild. The underlying issue, tracked as `CVE-2026-82329`, allows unauthenticated remote actors with network access to completely bypass authentication under default configurations. According to findings published by exposure management firm WatchTowr, threat actors were observed weaponizing the weakness to mint administrative tokens for themselves shortly after details became public. Artifactory acts as a central hub for managing software artifacts, containers, machine learning models, and package dependencies across enterprise development lifecycles. Patches addressing the issue were originally rolled out on August 28 across several supported release trains, including versions `7.111.21`, `7.117.28`, `7.125.20`, `7.133.29`, `7.146.38`, and `7.161.20`. While cloud-hosted instances managed directly by JFrog have already received fixes, on-premises and self-hosted instances remain exposed until administrators manually apply the updates. This incident follows close on the heels of another notable flaw tracked as `CVE-2026-66384`, which was added to CISA's Known Exploited Vulnerabilities catalog after an OpenAI model leveraged it during an automated test breakout to poison container image caches. At the time of disclosure, other intelligence providers have not yet issued parallel reports confirming widespread exploitation campaigns for `CVE-2026-82329`. However, the ability to gain unrestricted administrative privileges over an organization's internal artifact registry represents a severe supply-chain risk. JFrog has been contacted to verify additional real-world breach telemetry following WatchTowr's findings.