Artifactory CVE-2026-82329: Empty Key, Admin Access

What is CVE-2026-82329?

It is an authentication flaw (CWE-287) in the JFrog Access service, which manages identity and tokens for Artifactory. According to Fastly's analysis, the service splits a configuration string on commas without filtering empty entries. On a default install, an empty string therefore becomes a trusted join key. Its signing secret is constant, derived from empty input, and so identical across affected installs.

JFrog published the advisory on August 28, 2026. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on September 2.

How does the attack work?

The attack takes four steps, none needing prior authentication:

1. Compute the SHA-256 of the empty string and use it as the key ID (kid).
2. Forge an HS256-signed JWT with the constant secret.
3. Send it to POST /access/api/v1/registry/join (or the /join/router variants).
4. Receive a service-scoped token, which can be exchanged for a non-expiring platform admin token.

Fastly saw the first probes on August 29 and 30, about 75,000 attempts on August 31 (mostly from offensive security researchers), more than 171,000 on September 1 after a public exploit appeared, then a peak of about 406,000 on September 2. These numbers show how fast disclosure turns into mass exploitation: four days.

Who is affected and which versions fix it?

Self-hosted Artifactory instances that were not hardened, meaning no extra join key was configured. Fastly does not publish an explicit vulnerable range but lists the fixed versions per branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20. Check the JFrog advisory for your exact branch, since some secondary sources quote other numbers.

JFrog-hosted SaaS is not described as affected in the sources we reviewed; confirm with your JFrog contact.

How do you detect exploitation?

The short answer: look for calls to the join endpoint and for administrators you do not recognize.

• In HTTP logs and Access service logs, search for requests to /access/api/v1/registry/join and its variants. Fastly treats an HTTP 201 response as confirmed compromise, especially with the key ID computed on the empty string.
• Audit the administrators, repositories, tokens and configuration changes created since August 28, 2026.
• Look for the user agents of scanning tools (JFrogArtifactory/7.146.25) and of the public exploit (jfrt/0/7.161.19).

How do you fix and contain it?

1. Upgrade to the fixed version for your branch.
2. Treat the instance as compromised if it was exposed. The patch does not revoke tokens already issued. Rotate the join key, revoke tokens created since August 28, and change credentials stored in the platform.
3. Configure a strong join key (a random value) if you cannot upgrade immediately; several analyses describe this workaround, to be confirmed with JFrog.
4. Restrict the network: the /access/api/v1/registry/* API should not be reachable from the internet.
5. Verify the integrity of artifacts published during the exposure window: Docker images, packages, build binaries. Compare digests with those from your pipelines.

The topic ties into supply chain attacks: see our guide to npm, Composer and pip supply chain attacks and the article on the LiteLLM 1.107.0 compromise.

What changes when an AI agent has access to Artifactory?

An AI agent that can read or write in an artifact repository inherits trust across the whole build chain, and compromising it has cascading effects. Four points stand out.

Credentials live near the agent. Development agents (coding assistants, CI agents) often use an Artifactory token present in their environment or context. A token stolen through this flaw or through prompt injection gives lasting access to your repositories, all the more because the forged admin token does not expire.

Poisoning becomes automatic. If an agent installs dependencies or deploys images from Artifactory, a substituted artifact is consumed without human review. The agent runs it, tests it and sometimes publishes the result: the attack spreads at pipeline speed.

The agent can be the target of injection. A README, commit message or package description from a compromised artifact can contain instructions the agent reads as context. This is the indirect prompt injection described on our dedicated page, applied to the software supply chain. It overlaps LLM03 (Supply Chain) and LLM06 (Excessive Agency) in the OWASP Top 10 for LLM Applications.

MCP servers widen the surface. An MCP server that exposes Artifactory to an agent (package search, download, publish) gives the agent the rights of the token it carries. See our page on MCP security.

Useful measures: minimal-scope, short-lived tokens per agent task, a separate agent identity that is read-only by default, signature and digest checks before any deployment, human approval for publishing artifacts, and logging of every tool call to the repository.

How do you test your exposure?

Inventory the reachable Artifactory instances, the tokens your agents hold and the actions they can chain. Our Agent Red Team Express (EUR 1,900, 5 days) attacks a real agent with its tools and credentials, including access to an artifact repository, and delivers a report with reproducible evidence.