JFrog Artifactory: Unauth Token Chain to Admin + Rust Backdoor

Attackers are going after JFrog Artifactory, where build pipelines store their artifacts. Attackers have been chaining JFrog Artifactory flaws to go from no login to administrator in minutes, then planting Groovy plugins and a custom Rust backdoor.

If self-hosted Artifactory was reachable and unpatched through early September, patching alone does not revoke the tokens or admin accounts they already minted.

What happened

Wiz Research reported in-the-wild exploitation between August 15 and September 8, 2026. Two flaws were chained:

• CVE-2026-42018 — even with anonymous access disabled, an unauthenticated caller can obtain an internal anonymous-user token from a token endpoint.
• CVE-2026-42016 — that low-privilege token can be exchanged for an administrator-scoped token because Artifactory validated signature/issuer but not what the token was allowed to request.

In observed cases, attackers moved from the first request to a new admin account in under five minutes. Logs often show powerful actions as token:anonymous. A third critical auth bypass, CVE-2026-82329 (CVSS 9.8), was exploited separately against newer branches and can grant admin alone.

CISA added CVE-2026-42016 and CVE-2026-42018 to KEV on September 11, 2026 (federal due September 25). CVE-2026-82329 was already on KEV with an earlier due date.

Why it matters

Artifactory sits in the path of every binary your pipelines trust. Admin on that box means malicious packages, poisoned plugins, stolen join keys, and a foothold that survives the next developer push.

The risk extends to everything that builds from that server, not just the server itself.

What to do first

• Upgrade self-hosted Artifactory to the fixed build for your release train (see JFrog advisories). Cloud instances: confirm vendor posture; do not assume “someone else patched.”
• For CVE-2026-82329 if you cannot upgrade immediately: add an extra random join key in system.yaml per JFrog’s workaround so only your keys register.
• Audit admin users — Wiz saw PoC names (0xTerror, svc_/labadmin_*) and lookalikes (jfrog-distribution, repo-service). Delete strangers.
• Revoke access tokens minted since at least late August; rotate the cluster join key if it could have leaked.
• Hunt malicious Groovy plugins, unexpected plugin-execution shell, and droppers writing binaries under world-writable paths such as /tmp.

Details

• CVEs: CVE-2026-42018 (anon token leak), CVE-2026-42016 (token scope escalation), CVE-2026-82329 (standalone admin auth bypass, CVSS 9.8)
• Product: Self-hosted JFrog Artifactory (multiple 7.x trains)
• KEV: 42016/42018 added 2026-09-11 (due 2026-09-25); 82329 earlier (due 2026-09-05)
• Example fixed builds: branch-dependent — e.g. 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20 for 82329; confirm your train in JFrog’s matrix
• Post-exploit: admin accounts, Groovy plugins, Rust C2 backdoor, join-key theft

Hunt / verify

• Search access logs for unauthenticated POST /access/api/v1/aws/token/ (trailing slash) followed by POST /access/api/v1/tokens.
• Flag admin actions attributed to token:anonymous or low-privilege identities creating tokens/plugins.
• Inventory plugins and recently modified repositories; rotate secrets that lived in Artifactory config.

Sources

• Wiz: Artifactory under attack — CVE-2026-42016 / 42018 / 82329
• The Hacker News: Attackers chain JFrog Artifactory flaws (Sep 11, 2026)
• CISA: three KEV additions including Artifactory (Sep 11, 2026)
• Kodem: Artifactory IOCs and first-hour runbook

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].