CVE-2026-82329

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.111.21 JFrog Artifactory versions prior to 7.117.28 JFrog Artifactory versions prior to 7.125.20 JFrog Artifactory versions prior to 7.133.29 JFrog Artifactory versions prior to 7.146.38 JFrog Artifactory versions prior to 7.161.20

Description JFrog Artifactory contains an authentication weakness in the JFrog Access component, which handles authentication and credentialing. Under default configurations, an unauthenticated attacker with network access can bypass the authentication boundary to obtain administrative privileges. This is achieved by abusing the join-key behavior; specifically, instances without an additional join key may use a predictable service key, allowing attackers to forge access and mint administrator tokens. Real-world exploitation has been reported, with attackers using the flaw to enumerate users, groups, and federated-access topology. Because Artifactory manages critical software supply chain assets such as container images, binaries, and AI models, an administrative compromise could potentially allow for artifact manipulation and downstream supply-chain poisoning.

Recommendations Upgrade to version 7.111.21 or the applicable fixed release for the respective branch. Upgrade to version 7.117.28 or the applicable fixed release for the respective branch. Upgrade to version 7.125.20 or the applicable fixed release for the respective branch. Upgrade to version 7.133.29 or the applicable fixed release for the respective branch. Upgrade to version 7.146.38 or the applicable fixed release for the respective branch. Upgrade to version 7.161.20 or the applicable fixed release for the respective branch. Restrict network exposure of Artifactory to trusted networks. Review recently created administrator accounts and tokens, and audit authentication events for unusual user or group enumeration. Rotate high-value credentials and validate the integrity of critical repositories and build artifacts if compromise is suspected.