Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
Summary: Threat actors began exploiting CVE-2026-82329, a CVSS 9.8 authentication bypass in JFrog Artifactory, on September 1, 2026, days after JFrog patched it in version 7.161.20 on August 28. watchTowr's Yordan Ganchev said instances without an additional join key configured receive a "phantom" join key that attackers abuse to forge access and mint administrator-level credentials, with observed activity including admin token generation and enumeration of users, groups, credential sets and federated access topologies.
Why it matters: An unauthenticated attacker with network access can reach admin rights on the system that hosts and distributes your binaries, which Ganchev describes as letting them tamper with build pipelines and push malicious changes downstream to customers. Exploitation arrived four days after the patch, and watchTowr saw backdoor users created in limited cases.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-82329
- Related
- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability Known Exploited Vulnerabilities · Sep 02, 2026