Security
Three Critical Artifactory Flaws Under Active Attack Enable Rapid Admin Takeover
Chained vulnerabilities in self-hosted JFrog Artifactory allow unauthenticated attackers to seize full administrative control in minutes, with exploitation already observed in the wild.
InfoQ
Three security vulnerabilities affecting JFrog Artifactory are being actively exploited to bypass authentication and grant attackers administrative access to internet-facing, self-hosted instances. According to threat intelligence firm Wiz.io, adversaries have successfully breached instances and established persistent control in under five minutes by chaining the flaws together.
The Vulnerabilities#
The three CVEs are relatively simple to exploit using basic HTTP requests:
- CVE-2026-42018 (high severity): Returns an internal anonymous-user JWT token to unauthenticated requesters, even when anonymous access should be disabled.
- CVE-2026-42016 (high severity): Fails to validate token scope, allowing an attacker with low-privileged credentials to escalate permissions.
- CVE-2026-82329 (critical severity): Permits unauthenticated attackers to directly obtain admin-scoped access tokens.
Attack Chain in the Wild#
Wiz.io observed a consistent exploitation pattern. Attackers first send an unauthenticated POST request to /access/api/v1/aws/token/ (with a trailing slash), which exploits CVE-2026-42018 to retrieve an anonymous-user JWT. They then exchange this token via a second POST to /access/api/v1/tokens, leveraging CVE-2026-42016's scope-validation weakness to escalate to admin privileges. The resulting token retains an anonymous username but carries full administrative authority.
Alternatively, CVE-2026-82329 can bypass these steps entirely, granting direct admin access in a single request.
Post-Exploitation Activity#
Once attackers achieve administrative control, Wiz.io documented multiple dangerous follow-up actions: creating persistent admin accounts, injecting malicious Groovy plugins for code execution, stealing credentials and signing keys, installing backdoors, and deploying anti-forensics tools to hide their tracks.
Supply Chain Risk#
Because Artifactory serves as a central hub in software build pipelines, a compromise poses direct supply-chain exposure. Security experts have warned the incident mirrors the severity and impact potential of major supply-chain incidents. JFrog has released patches in versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20, and newer across affected release branches. Organizations should apply updates immediately and audit exposed instances for signs of prior compromise.
