DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-82329: CVE-2026-82329: Critical Authentication Bypass and Privilege Escalation in JFrog Artifactory

#security #cve #cybersecurity

CVE-2026-82329: Critical Authentication Bypass and Privilege Escalation in JFrog Artifactory

Vulnerability ID: CVE-2026-82329
CVSS Score: 9.8
Published: 2026-08-28

CVE-2026-82329 is a critical authentication bypass vulnerability in the core authentication mechanisms of JFrog Artifactory. Classified under CWE-287, this security weakness allows remote, unauthenticated attackers to bypass authentication controls and obtain full administrative privileges on vulnerable self-managed deployments running default configurations.

TL;DR

A critical authentication bypass flaw in self-managed JFrog Artifactory instances allows remote, unauthenticated attackers to obtain full administrative privileges on systems running default or unhardened configurations.

Technical Details

  • CWE ID: CWE-287
  • Attack Vector: Network
  • CVSS Score: 9.8
  • EPSS Score: 0.00377
  • Exploit Status: none
  • KEV Status: false

Affected Systems

  • JFrog Artifactory Self-Managed (Versions up to 7.111.20)
  • JFrog Artifactory Self-Managed (Versions 7.117.0 to 7.117.27)
  • JFrog Artifactory Self-Managed (Versions 7.125.0 to 7.125.19)
  • JFrog Artifactory Self-Managed (Versions 7.133.0 to 7.133.28)
  • JFrog Artifactory Self-Managed (Versions 7.146.0 to 7.146.37)
  • JFrog Artifactory Self-Managed (Versions 7.161.0 to 7.161.19)
  • Artifactory Self-Managed: < 7.111.21 (Fixed in: 7.111.21)
  • Artifactory Self-Managed: >= 7.117.0, < 7.117.28 (Fixed in: 7.117.28)
  • Artifactory Self-Managed: >= 7.125.0, < 7.125.20 (Fixed in: 7.125.20)
  • Artifactory Self-Managed: >= 7.133.0, < 7.133.29 (Fixed in: 7.133.29)
  • Artifactory Self-Managed: >= 7.146.0, < 7.146.38 (Fixed in: 7.146.38)
  • Artifactory Self-Managed: >= 7.161.0, < 7.161.20 (Fixed in: 7.161.20)

Mitigation Strategies

  • Upgrade the JFrog Artifactory self-managed instance to a patched version immediately.
  • Regenerate default cryptographic platform keys (master.key and join.key) with high-entropy values.
  • Enforce network segmentation on ports 8081, 8082, and internal communication ports.
  • Disable anonymous access within Artifactory's system settings.

Remediation Steps:

  1. Check the running version of Artifactory via the administrative dashboard or HTTP system endpoint.
  2. Identify the corresponding fixed patch version from the Artifactory release notes.
  3. Back up all configuration files, data stores, and keystores prior to starting the upgrade.
  4. Apply the patch upgrade package following the vendor's standard upgrade procedures.
  5. Regenerate cluster join keys and platform master keys to remove potentially pre-calculated legacy files.
  6. Restrict ingress traffic to the host ports to authorized development systems and continuous integration build nodes only.

References

Read the full report for CVE-2026-82329 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)