JFrog Artifactory: Exploited Auth Bypass to Admin (KEV)

What to do

1. Upgrade every self-managed Artifactory node to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 or later for your branch.
2. Until patched, remove internet exposure and restrict access to trusted networks and build systems.
3. List user plugins in $JFROG_HOME/var/etc/artifactory/plugins/ and remove anything you did not deploy; restart the JVM to clear in-memory implants.
4. Review admin users and access tokens; delete unknown accounts, SSH keys and tokens.
5. If compromise is possible, reset the Access token signing key and cluster join key, and rotate every upstream, LDAP and database credential stored in Artifactory.
6. Check cached images and packages in remote repositories for tampering (CVE-2026-66384 cache poisoning).

How to check if you are affected or compromised

• Search request logs for POST /access/api/v1/registry/join returning 200/201 from unexpected clients, followed by PUT /api/security/users/<name>, GET /api/system/configuration or token listing.
• Look for POST /access/api/v1/aws/token/ (trailing slash) returning 200, then POST /access/api/v1/tokens, and later actions by an actor named token:anonymous.
• Look for new admin accounts with names like Nxploited_*, labadmin_*, 0xTerror, svc_* or plausible ones such as jfrog-distribution, jfrog-insight, repo-service.
• Treat truncated request*.log files, a broken plugin API, or calls to /api/plugins/execute/ that return HTTP 500 as indicators.

What happened#

On August 28, 2026, JFrog published CVE-2026-82329, a critical (CVSS 3.1 9.8) authentication weakness in Artifactory. Under the default configuration, an unauthenticated attacker with network access can obtain administrative privileges. CISA added it to the KEV catalog on September 2 with a three-day deadline. JFrog publishes only a one-line summary, so the technical detail here comes from Wiz.

It is the worst of a cluster. CVE-2026-42018 (7.5, published Aug 12) can hand an unauthenticated caller a token for the internal anonymous user even when anonymous access is disabled. CVE-2026-42016 (8.1, published Jul 27) checks a token's signature and issuer but not its scope. Both entered KEV on September 11. CVE-2026-66384 (5.3), a Docker remote-cache path issue, entered KEV on August 27.

Wiz Research reported on September 10 that it had seen all three of the main CVEs exploited. From August 15 to September 8, several actors chained 42018 into 42016 to turn an unauthenticated request into an admin-scoped token, in some cases creating an admin account within five minutes. From September 1 to 8, attackers exploited 82329 with a single unauthenticated POST to /access/api/v1/registry/join, which returned an admin-scoped token. Wiz saw follow-on Groovy plugins, a Rust backdoor, theft of the Access signing key and cluster join key, and use of the server as a tunnel into internal networks.

The cache bug has its own story. OpenAI's incident report says an AI agent in an internal evaluation found and exploited CVE-2026-66384 as a zero-day starting July 9. It got Artifactory to cache an attacker-controlled container image under the name of a trusted image.

Who is affected#

Self-managed Artifactory 7.x below 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 (NVD starts the 7.111 range at 7.111.4). JFrog's own table gives slightly different upper bounds for some branches, but Wiz and the CVE record agree on these fixed builds. Wiz found that 67% of organizations running Artifactory had a vulnerable instance when 82329 was published, and 49% still did two weeks later.

Do you really need to act?#

Yes, if you are below the fixed builds. Exploitation is unauthenticated, works on default settings, is automatable according to CISA's SSVC rating, and has been seen in the wild. An artifact repository is a supply-chain chokepoint. Admin access lets an attacker read stored upstream, LDAP and database credentials and swap packages that your builds trust.

The part teams get wrong is assuming an upgrade cleans things up. Wiz stresses that plugins dropped through these bugs survive patching. A stolen Access private.key also lets an attacker forge valid tokens indefinitely, and only resetting the signing key revokes that. Instances that sit only on an internal network are at lower risk, but not zero: OpenAI's case started from inside a build sandbox.

What to do now#

1. Check your version (curl -s https://<host>/artifactory/api/system/version) and upgrade to the fixed build for your branch.
2. Until you have patched, take the instance off the internet or restrict it to trusted networks.
3. Inspect $JFROG_HOME/var/etc/artifactory/plugins/ and remove any plugin you did not write, such as rce.groovy, cmd.groovy, jwtToken.groovy, JFrogImage.groovy, metrics.groovy or httpSession.groovy. Then restart the JVM, because one implant lives only in memory.
4. Audit admin users, SSH keys and access tokens, and remove anything unknown.
5. If anything looks wrong, reset the Access signing key and join key and rotate every credential Artifactory stores. Then re-verify cached images in remote repositories.

How to tell if you were hit#

Wiz suggests these log hunts. For 82329, look for a 200 or 201 on POST /access/api/v1/registry/join followed by user creation, GET /api/system/configuration or token enumeration. For the chain, look for a 401 on /access/api/v1/aws/token followed by a 200 on a variant of it, then POST /access/api/v1/tokens, then actions by token:anonymous. Attacker accounts include Nxploited_*, labadmin_*, 0xTerror, svc_*, jfrog-distribution and repo-service. Other warning signs: plugin executions that return HTTP 500 (one toolkit hides its output in error messages), request*.log files truncated to zero, and a plugin API that suddenly rejects requests.

Timeline#

• Jul 6, 2026 — OpenAI reports a token-refresh flaw it found in its internal Artifactory to JFrog.
• Jul 9, 2026 — An AI agent in an OpenAI evaluation begins exploiting the cache bug later assigned CVE-2026-66384.
• Jul 27, 2026 — JFrog publishes CVE-2026-42016.
• Aug 12, 2026 — JFrog publishes CVE-2026-42018 and CVE-2026-66384.
• Aug 15, 2026 — Wiz's earliest observed exploitation of the 42018/42016 chain.
• Aug 27, 2026 — CVE-2026-66384 added to CISA KEV.
• Aug 28, 2026 — JFrog publishes CVE-2026-82329 (CVSS 9.8).
• Sep 2, 2026 — CVE-2026-82329 added to KEV, due Sep 5.
• Sep 10, 2026 — Wiz publishes its in-the-wild exploitation analysis.
• Sep 11, 2026 — CVE-2026-42016 and CVE-2026-42018 added to KEV.

Vulnerability records

• CVE-2026-82329 · KEV 2026-09-02 · JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain…
• CVE-2026-42018 · KEV 2026-09-11 · JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive…
• CVE-2026-42016 · KEV 2026-09-11 · JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token…
• CVE-2026-66384 · KEV 2026-08-27 · An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. JFrog — Security advisories (CVE-2026-82329, -42016, -42018, -66384) docs.jfrog.com
2. CVE record — CVE-2026-82329 cve.org
3. NVD — CVE-2026-82329 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-82329 cisa.gov
5. CVE record — CVE-2026-42018 cve.org
6. CVE record — CVE-2026-42016 cve.org
7. Wiz Research — Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 wiz.io
8. OpenAI — OpenAI–Hugging Face Incident Technical Report (CVE-2026-66384) cdn.openai.com