JFrog Artifactory Flaws

Overview

Security researchers at Wiz have revealed that attackers chained two vulnerabilities in JFrog Artifactory to escalate privileges and gain administrator control of self‑hosted servers. Once inside, they planted backdoors, created admin accounts, and deployed malicious plugins. The attacks occurred between August 15 and September 8, 2026, targeting servers that had not yet applied JFrog’s fixes.

Vulnerability Chain

• CVE‑2026‑42018: Artifactory mistakenly handed out an internal anonymous‑user token to unauthenticated callers, even when anonymous access was disabled.
• CVE‑2026‑42016: Allowed attackers to swap a low‑privilege token for one with administrator scope.
• Attack pattern:
  1. Request token as “anonymous.”
  2. Exchange it for an admin‑scope token.
  3. Use it to create administrator accounts or execute malicious actions.
• Logs showed activity under token:anonymous, masking attacker identity.

Exploitation in the Wild

• Attackers created administrator accounts with names like 0xTerror, svc_..., or disguised as legitimate services (jfrog‑distribution, repo‑service).
• Deployed malicious Groovy plugins for code execution.
• Ran shell commands to explore files.
• Dropped binaries into /tmp and opened C2 channels.
• Deployed a custom Rust backdoor with command‑and‑control features.

Additional Critical Flaw

• CVE‑2026‑82329: Authentication bypass rated CVSS 9.8.
• Exploited separately between September 1–8, requiring no chained flaws.
• Allowed unauthenticated attackers to gain admin privileges directly.
• Public exploit appeared on September 1; Fastly observed 406,000 exploitation attempts the next day.
• Attackers stole cluster join keys and system configurations.

Defensive Guidance

• Upgrade Artifactory: Apply fixed builds listed in JFrog advisories.
• Rotate join keys and revoke tokens issued since late August.
• Audit administrator accounts for unauthorized additions.
• Review repositories and plugin configurations for malicious changes.
• Monitor logs for anonymous or low‑privilege accounts performing admin actions.
• Apply workarounds if patching is delayed (e.g., adding random join keys in system.yaml).

Expert in the Cloud Insight

These incidents highlight how token mismanagement and authentication bypasses can devastate DevOps pipelines. Attackers leveraged Artifactory’s role as a central repository to implant persistence and backdoors. The lesson is clear: patch immediately, rotate secrets, and audit admin accounts—because once attackers control your build pipeline, they control your software supply chain.