CVE-2026-82329: JFrog Artifactory Phantom Join-Key Authentication Bypass

HTS

HERMES THREAT SCORE & OPERATIONAL EXPLOITABILITY

Target: JFrog Artifactory Self-Hosted Deployments (JFrog Access Service)

Confidence: 99%

98 / 100

EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 15 / 20

Prevalence 13 / 20

Impact 10 / 20

⚖️ Divergence & Operational Rationale

Rated 98 EXTREME by Hermes due to active wild exploitation against enterprise CI/CD pipelines, CISA KEV catalog listing (September 2, 2026), and catastrophic software supply-chain impact allowing unauthenticated attackers to poison container registries and AI model repositories.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-82329: JFrog Artifactory Phantom Join-Key Authentication BypassVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTJFrog Artifactory

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in JFrog Artifactory documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Active Exploitation in the Wild

This vulnerability is confirmed by CISA to be under active exploitation by nation-state and cybercrime threat actors targeting enterprise software supply chains. Added to CISA KEV on September 2, 2026, with mandatory remediation required under BOD 26-04.

Executive Summary

CVE-2026-82329 (CVSS v3.1: 9.8 Critical, CWE-287 Improper Authentication) is an authentication bypass vulnerability affecting self-hosted installations of JFrog Artifactory. The flaw resides within JFrog Access, the security and identity subsystem governing cross-node communication and credential issuance. In out-of-the-box configurations where an administrator has not explicitly provisioned an auxiliary cluster join key, the Access microservice evaluates incoming node join and token minting requests against a predictable “phantom” join-key state. Unauthenticated remote adversaries with network access to the Artifactory instance can exploit this defect to forge valid administrative credentials, establish rogue service identities, and achieve full administrative control. Compromise grants read and write authority across all enterprise repositories, enabling source code theft, binary backdooring, AI model weight poisoning, and lateral movement into production deployment environments. Patched releases include 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20.

Root Cause Analysis

JFrog Artifactory relies on a modular microservices architecture. Central to this architecture is JFrog Access, a dedicated service handling user authentication, group synchronization, token verification, and internal node-to-node cluster trust:

JFrog Artifactory Architectural Trust Boundary & The "Phantom" Key Flaw:

  Incoming Attacker Request (Unauthenticated)
                 │
                 ▼
  [Artifactory Gateway / Nginx Reverse Proxy]
                 │
                 ▼
  [Internal Microservice Route: /access/api/v1/...]
                 │
                 ▼
  Node Registration & Join Handshake:
  ┌────────────────────────────────────────────────────────────────────────┐
  │ JFrog Access Credential Verification Engine:                           │
  │                                                                        │
  │   1. Read system join-key from bootstrap file or environment:          │
  │      `joinKey = readKeyFromConfig()`                                   │
  │                                                                        │
  │   2. [VULNERABILITY PATHWAY]                                           │
  │      If joinKey is unconfigured / null in default deployments:        │
  │      Engine does NOT reject registration or enforce secure bootstrap.  │
  │      Instead, it falls back to an unseeded, deterministic "Phantom"   │
  │      fallback state within memory.                                     │
  │                                                                        │
  │   3. Signature Verification using Phantom Secret:                      │
  │      `isValid = verifyHMAC(requestSignature, phantomKey)` -> TRUE     │
  └────────────────────────────────────────────────────────────────────────┘
                 │
                 ▼
  [Full Administrative Token Minted: jfrog-admin-token]
                 │
                 ▼
  Complete Takeover of Enterprise Package & AI Model Repositories

The “Phantom” Join-Key Architectural Defect

To facilitate high-availability clustering and automated container scaling, JFrog Access utilizes a shared symmetric secret called the Join Key. This key authenticates worker nodes and inter-service RPC handshakes without requiring human credential entry during container startup.

The vulnerability stems from two compounding architectural flaws in the Access service’s initialization lifecycle:

1. Unenforced Bootstrap Key Generation: In default, self-hosted deployments (particularly those deployed via Docker Compose or Helm charts without explicit secret management), the initialization script permitted the Access daemon to start even if the join key was unset or empty in bootstrap.creds or system.yaml.
2. Defective Fallback Cryptographic Validation: When validating token-minting requests signed by an alleged internal service, the validation routine did not throw a fatal security exception upon encountering a null join key. Instead, the HMAC calculation routine proceeded with an internal default constant / empty buffer.

Consequently, an attacker who understands the deterministic fallback behavior can construct a node registration or administrative token request, calculate the HMAC signature matching the phantom state, and submit it to the Access API. The server verifies the signature, concludes that the request originated from a legitimate internal cluster node, and responds with a freshly minted, long-lived JWT granting full admin privileges across the Artifactory instance.

Exploit Mechanics & Supply Chain Impact

The attack requires network connectivity to the Artifactory web interface or API port (typically 8081 or 8082) but requires no prior authentication, valid user account, or special network position.

1. Attacking the Access Handshake

The adversary sends a crafted HTTP request to the internal token-generation endpoint of JFrog Access:

POST /access/api/v1/tokens HTTP/1.1
Host: artifactory.enterprise.internal:8082
Content-Type: application/json
X-JFrog-Join-Signature: <HMAC_Computed_Over_Phantom_Key_Buffer>

{
  "username": "admin-bootstrap-recovery",
  "scope": "applied-permissions/admin",
  "expires_in": 31536000,
  "refreshable": true
}

The Access daemon matches the computed signature against its uninitialized in-memory secret, validates the request, and issues an administrative API bearer token:

{
  "token_id": "9f42d13b-8210-4e3a-9281-c91823290001",
  "access_token": "eyJ2ZXIiOiIyIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ...",
  "expires_in": 31536000,
  "scope": "applied-permissions/admin",
  "token_type": "Bearer"
}

2. Supply Chain Poisoning & Weaponization Scenarios

With complete administrative privileges, adversaries execute multi-stage supply chain attacks:

• Container Registry Poisoning (Docker / OCI): Threat actors overwrite golden base images (python:3.11-slim, node:20-alpine, internal enterprise microservices) with backdoored variants containing reverse shells or credential-harvesting implants.
• Package Dependency Hijacking (PyPI / npm / Maven / Go): Internal package registries are modified to serve malicious dependency releases. When developers or CI/CD pipelines run npm install or pip install, the backdoored libraries execute post-install scripts that compromise developer workstations and build runners.
• AI & LLM Model Poisoning: Artifactory is increasingly used to store proprietary fine-tuned weights, Hugging Face models, and GGUF checkpoints. Attackers manipulate model tensors or inject serialized pickle payloads into model registries, turning internal AI pipelines into remote code execution conduits.
• CI/CD Secret Exfiltration: Harvesting deploy tokens, cloud access keys (AWS, Azure, GCP), and code signing certificates stored in Artifactory configuration secrets.

Forensic Markers & Threat Hunting Guide

DFIR teams investigating self-hosted JFrog Artifactory deployments must inspect access logs, internal microservice telemetry, and artifact integrity logs:

1. Access HTTP Request Telemetry

Review reverse proxy access logs (Nginx/HAProxy) and the internal Artifactory request log (artifactory-request.log and access-request.log):

• Anomalous Calls to Access Endpoints: Unauthenticated HTTP POST requests to /access/api/v1/tokens, /access/api/v1/service_id, or /access/api/v1/nodes/join originating from external or non-cluster IP addresses.
• Unusual Token Issuance Entries: Look for log entries in access-security-audit.log recording the creation of admin-level tokens with uncharacteristic user names or non-existent user accounts:

  2026-09-03T14:22:18.112Z|TOKEN_CREATED|IP=198.51.100.44|USER=admin-bootstrap-recovery|SCOPE=applied-permissions/admin

• Status Code Anomaly: Requests to token endpoints from untrusted sources returning 200 OK rather than 401 Unauthorized or 403 Forbidden.

2. Artifact Repository Integrity Verification

• Audit Overwritten Package Checksums: Query the Artifactory database or audit log for recent package updates where a published version’s SHA-256 hash changed without a corresponding source-code commit:

  # Check for modified package timestamps on critical repositories
  curl -s -H "Authorization: Bearer $TOKEN" \
    "https://artifactory.corp/artifactory/api/storage/docker-prod-local?list&deep=1"

• Inspection of Build Metadata: Verify build info files (artifactory-build-info) for unexpected build numbers, unauthorized publishers, or missing cryptographic signatures.

3. Service Configuration Auditing

Inspect the deployment’s system.yaml or container environment variables:

• If shared.security.joinKey is missing or commented out, the instance was vulnerable during its operational lifetime.

Detection Rules

Sigma Rule

title: JFrog Artifactory Unauthorized Administrative Token Generation (CVE-2026-82329)
id: 82329b01-4f10-4e2b-a823-290000082329
status: experimental
description: Detects suspicious administrative token creation requests directed at JFrog Artifactory Access endpoints, indicative of CVE-2026-82329 exploitation.
references:
  - https://jfrog.com/help/r/jfrog-security-advisories/cve-2026-82329
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Hermes Codex CTI
date: 2026-09-08
logsource:
  category: webserver
  product: jfrog_artifactory
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/access/api/v1/tokens'
      - '/access/api/v1/nodes/join'
  selection_status:
    sc-status: 200
  filter_internal_nodes:
    c-ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.1/32'
  condition: selection_endpoint and selection_status and not filter_internal_nodes
falsepositives:
  - Legitimate cluster additions from authorized remote subnets (correlate with IT change management).
level: critical
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1190
  - attack.t1078.004
  - cve.2026.82329

Splunk Search

index=jfrog sourcetype="jfrog:access:audit" action="TOKEN_CREATED" scope="*admin*"
| rex field=message "IP=(?<client_ip>[^|]+)\|USER=(?<username>[^|]+)"
| where NOT cidrmatch("10.0.0.0/8", client_ip) AND NOT cidrmatch("172.16.0.0/12", client_ip) AND NOT cidrmatch("192.168.0.0/16", client_ip)
| stats count earliest(_time) as first_seen latest(_time) as last_seen by client_ip, username, scope
| sort - count

Mitigation & Remediation Matrix

1. Mandatory Version Upgrade

All organizations operating self-managed instances of JFrog Artifactory must immediately upgrade to the fixed release corresponding to their deployment stream:

Release Stream	Vulnerable Versions	Fixed Patched Version
7.111.x	≤ 7.111.20	7.111.21
7.117.x	≤ 7.117.27	7.117.28
7.125.x	≤ 7.125.19	7.125.20
7.133.x	≤ 7.133.28	7.133.29
7.146.x	≤ 7.146.37	7.146.38
7.161.x	≤ 7.161.19	7.161.20

Note: JFrog Cloud (SaaS) environments were remediated directly by JFrog; no customer action is required for cloud-managed instances.

2. Post-Patch Credential & Token Revocation

Because attackers exploiting CVE-2026-82329 mint persistent tokens that survive software upgrades, patching alone is insufficient:

1. Audit Active Tokens: Export all active access tokens via the Artifactory Access API or UI.
2. Revoke Unrecognized Tokens: Revoke all tokens generated within the period of vulnerability that cannot be traced to legitimate automated service accounts.
3. Provision Explicit Join Keys: Explicitly configure a high-entropy 256-bit join key in system.yaml:

   shared:
     security:
       joinKey: "<GENERATE_64_CHAR_HEX_ENTROPY_KEY>"

4. Network Perimeter Restriction: Ensure ports 8081 and 8082 are shielded behind corporate VPNs or firewall access lists and not directly exposed to the public Internet.

---

Sources & References

• CISA Known Exploited Vulnerabilities: BOD 26-04 Addition (September 2, 2026)
• JFrog Security Advisory: Official Vendor Bulletin for CVE-2026-82329
• NIST National Vulnerability Database: CVE-2026-82329 Detail
• Related Codex Studies: Semantic Supply Chain Risks and Runtime Policy Enforcement