JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners

What Changed

CVE-2026-82329 is a critical (CVSS 9.8) authentication bypass in self-hosted JFrog Artifactory’s Access service. On default installs, a join-key configuration string that is empty still contributes an empty entry to the set of trusted cluster join keys. That empty key has a deterministic signing secret. An attacker can forge an HS256 join JWT whose kid is the SHA-256 of an empty string, present it to the unauthenticated registry join endpoint, and mint a service-scoped admin token that exchanges into a full platform admin token. No login. No user interaction. One HTTP request.

JFrog disclosed the issue on August 28, 2026. watchTowr reported attackers minting administrator tokens by September 1. CISA added the CVE to KEV on September 2. Fastly’s edge telemetry shows the classic acceleration curve: quiet probing after disclosure, then a jump past 171,000 attempts on September 1 once a public exploit landed, peaking around 406,000 attempts on September 2 with nearly 1,400 attacking IPs. Mass scanners used User-Agents such as JFrogArtifactory/7.146.25; more targeted operators showed up with the PoC-default jfrt/0/7.161.19.

Fixed builds by branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. JFrog’s cloud-hosted SaaS was reported as already protected; this is a self-managed problem. One painful footnote for teams racing an earlier Artifactory KEV deadline: builds that close a different September deadline (for example 7.146.35 / 7.161.16 in public reporting) can still leave CVE-2026-82329 open. Patch to the build that actually closes *this* CVE.

Why This Matters Operationally

Artifactory sits in the software supply chain the way a loading dock sits in a warehouse. Admin access means repositories, credentials stored for upstream registries, CI tokens, signing material, and the ability to publish packages your build systems will happily trust tomorrow morning. This is not “someone browsed our UI.” It is “someone can rewrite what ‘latest’ means.”

The empty-string join key is also a useful reminder that default cluster-join convenience is an authentication decision. If the join endpoint is reachable from networks you do not fully trust, you effectively invited every scanner that learned the kid e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 to try on a tuxedo and walk in as admin.

What Defenders Should Verify First

Upgrade to a fixed build for your branch (7.111.21 / 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20). Confirm the running version, not the ticket that said “patched Artifactory.”
Hunt join-endpoint success. Search for POST /access/api/v1/registry/join (and /join/router variants). Treat HTTP 201 on those paths—especially with the empty-string kid—as compromise until proven otherwise.
Revoke and rotate. Rotate the platform join key. Revoke access tokens issued since August 28, 2026. Audit unexpected admin users, groups, permission targets, federated topologies, and new repositories.
Inventory secrets the registry could reach. Package-source credentials, cloud keys, signing keys, and CI service accounts that Artifactory stored or proxied should be rotated at the issuer.
Shrink exposure. Keep Access/Artifactory admin and join endpoints off the public internet; put WAF/virtual-patch controls in front while you finish upgrades.

Source Context

Patching stops new token minting. It does not recall tokens already printed. If the join endpoint answered 201 during the window, assume admin walked in without knocking.

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.