JFrog Artifactory Auth Bypass (CVE-2026-82329): How Attackers Are Skipping Login Entirely

# JFrog Artifactory Auth Bypass (CVE-2026-82329): How Attackers Are Skipping Login Entirely

If you run self-hosted JFrog Artifactory anywhere near your CI/CD pipeline, this one deserves priority attention.

CVE-2026-82329 is a critical authentication bypass (CVSS 9.8, CWE-287) that JFrog disclosed on August 28, 2026. The root cause centers on incorrect refresh-token signature validation — under default configuration, a request can be treated as if it came from a legitimately signed administrator token. No valid username, password, or session required.

Just days after disclosure, watchTowr's threat intel team confirmed active exploitation in the wild, with attackers "minting themselves admin tokens." That's the part that should worry every DevOps team — this isn't theoretical, it's happening now against internet-exposed instances.

Why it matters for devs specifically:
Artifactory stores your containers, binaries, build dependencies, and release packages — and CI/CD systems pull from it automatically, usually without a human reviewing every fetch. An attacker with a forged admin token can swap trusted internal packages for backdoored versions, exfiltrate signing keys/secrets, and plant persistent service accounts that survive a routine password reset (because they were never tied to a real user account in the first place).

Quick checks for your team:

• Confirm your version via /artifactory/api/system/version against JFrog's patched releases
• Audit active tokens via the Access REST API for unrecognized admin-scoped tokens
• Grep access-audit logs for unexpected CreateToken events

Patched versions: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 (cloud instances are already fixed — no action needed there).

I wrote a full deep-dive covering the attack scenario, IOCs, diagnostic commands, and a complete hardening checklist:
👉 https://www.xpert4cyber.com/2026/09/jfrog-artifactory-auth-bypass-cve-2026-82329.html

Curious how other teams are handling token revocation post-patch — reset-and-reissue everything, or targeted audit first?