Article: JFrog disclosed a critical authentication bypass in its self-hosted Artifactory product (CVE-2026-82329) on August 28, 2026. The flaw, a 9.8-score CVSS, lets an attacker forge an administrator token and seize full control without a username, password, or session. Threat-intel teams say the attack is already hitting internet-facing installations.

How the bug works

Artifactory’s refresh-token mechanism checks a digital signature to verify a token. In the default configuration, the validation routine accepts a crafted token whose signature looks valid. An attacker can therefore mint a token that the server treats as an admin credential and issue any API call—create or delete repositories, expose source code, or drop malicious artifacts.

Who is at risk

  • Enterprises that run Artifactory on-premises – especially those exposing the service to the public internet.
  • Teams that rely on the default token-validation settings – the vulnerability disappears only when the validation logic is patched or manually hardened.
  • Cloud customers – are not directly affected because the managed service was updated before the public announcement.

Immediate steps for self-hosted users

  1. Identify your version – call /artifactory/api/system/version.
  2. Upgrade – move to one of the patched releases (7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20).
  3. Audit active tokens – use the Access REST API to list current tokens and flag any you do not recognize.
  4. Review audit logs – search the access-audit log for CreateToken events that were not generated by your CI/CD pipelines or automation tools.

If you cannot upgrade right away, isolate the Artifactory instance from the internet, shut down any unused token-creation endpoints, and rotate all existing admin tokens.

What JFrog says

JFrog’s advisory notes that the issue only appears under the product’s default configuration. Customers who have applied custom token-validation rules may already be protected, but the vendor still recommends upgrading. The company has released patches for all supported on-premise versions and confirmed that the cloud offering is already immune.

The takeaway is simple: if you run Artifactory on your own servers, verify your version today, apply the patch, and scrub your token inventory. The window for exploitation is already open; delaying remediation only widens the attack surface.