Patched JFrog Artifactory Flaws Chained for Admin and Backdoors

Two JFrog Artifactory vulnerabilities, both already patched, were chained by attackers to take administrator control of self-hosted servers and plant backdoors, cloud security company Wiz said. Artifactory is a repository platform, meaning a server that stores software packages and build artifacts that developers download during automated builds. Wiz observed the attacks between August 15 and September 8. JFrog had fixed both flaws before that period, so only installations that had not applied the updates were open to attack. Neither flaw by itself grants administrator rights, but used together they allowed a complete takeover.

The first flaw, tracked as CVE-2026-42018, makes Artifactory hand over an internal token for its built-in anonymous user to a caller who has not logged in, even when anonymous access is disabled. A token is a digital credential that proves who you are or what you may do. The second flaw, CVE-2026-42016, then allows that low-privilege token to be exchanged for one carrying administrator scope. Artifactory checks a token's cryptographic signature and which authority issued it, Wiz explained, but it does not check what the token is actually allowed to do. In every case the security firm saw, the attacker first sent an unauthenticated request to a token endpoint and received a token for the internal anonymous user. Next, the attacker exchanged that token at Artifactory's token-creation endpoint for a token with administrator scope. That second token keeps the anonymous username, so administrator actions taken with it appear in server logs as token:anonymous rather than under a named account. In some attacks, the time from the initial request to creating a new administrator account was under five minutes. The chain only reaches servers that are vulnerable to both flaws. JFrog's published ranges show CVE-2026-42016 is fixed up to version 7.133.11, while the 7.146 and 7.161 branches fall outside that range. JFrog shipped the fix for CVE-2026-42018 on the 7.146 branch on April 28 and on the 7.133 branch on August 12, three days before the attacks Wiz observed began.

With administrator control, attackers did not follow one identical script. Wiz noted that no single actor carried out every step it observed. Across compromised servers, attackers created administrator accounts and left them in place. They also installed malicious Groovy plugins, small programs written in the Groovy language that Artifactory can load to run custom actions, through Artifactory's plugin framework, which allowed them to execute code on the server. Some attackers ran shell commands through the plugin execution endpoint to explore directories and list files. A dropper pulled a binary over HTTP, wrote it to a world-writable directory such as /tmp, a temporary folder that any user on the server can write to, and opened a command-and-control channel, the connection a compromised machine uses to receive instructions. Wiz said it also found a custom Rust backdoor, a hidden way for an attacker to re-enter a system later, with command-and-control features dropped in multiple cases.

A third JFrog Artifactory flaw, CVE-2026-82329, was exploited separately between September 1 and September 8. It is a critical authentication bypass rated 9.8 on the CVSS severity scale, where 10 is the most severe, and it targets Artifactory's default configuration, requiring no second flaw. An unauthenticated attacker with network access can obtain administrator privileges through it alone across six release branches up to version 7.161. The Hacker News reported on September 1 that attackers had begun creating administrator tokens through that flaw days after JFrog disclosed it. The U.S. Cybersecurity and Infrastructure Security Agency, CISA, added it to its catalog of known exploited vulnerabilities on September 2 and set a September 5 deadline for federal agencies to act. Content delivery network Fastly said in an analysis that a public exploit appeared on September 1 and scanning followed. Fastly counted about 406,000 exploitation attempts across its platform on September 2, its busiest day, though those are attempts seen in traffic and not confirmed compromises. On servers taken through that flaw, Wiz saw attackers read the system configuration and, in several cases, take the cluster join key, the shared secret Artifactory nodes use to register with one another.

JFrog's security advisories list fixed builds for each release branch, meaning a line of versions that receive fixes for that series. For CVE-2026-42018, the fixed versions are 7.111.20, 7.117.27, 7.125.19, 7.133.28, and 7.146.8. For CVE-2026-42016, the only fixed version JFrog lists is 7.133.11, with no separate fix for each branch. The advisory does not say whether a later build on an older branch, such as 7.117.28, also closes that flaw; The Hacker News has asked JFrog and Wiz for clarification. For CVE-2026-82329, the fixed versions are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. JFrog publishes a workaround for that third flaw for anyone who cannot upgrade quickly: generate a random value and add it as an extra join key in the system.yaml configuration file, so only keys you provide are accepted when a service registers. There is no interim option for the two chained flaws in any advisory or report consulted.

An important point for administrators is that installing a patch does not undo attacker changes. The administrator accounts created by attackers do not disappear when the software is updated. Wiz saw those accounts created both through the two-flaw chain and through CVE-2026-82329. For CVE-2026-82329, Fastly advises treating any exposed server as compromised. Fastly said a patch does not revoke tokens already minted. An upgrade also does not change a join key attackers have already taken. Fastly recommends rotating the platform join key, revoking access tokens issued since August 28, and reviewing administrator accounts, repositories, and configuration changes.

To detect whether an installation has been affected, watch for accounts doing things their privileges should not allow. The clearest signal is the internal anonymous user, or any low-privilege account, creating tokens, listing users, or reading and writing plugins. Next, look for administrator accounts that nobody created on purpose. Most of the ones Wiz saw have proof-of-concept names such as 0xTerror, or names beginning with svc_ and labadmin_ followed by random characters. Some were designed to blend in, with names like jfrog-distribution, jfrog-insight and repo-service. Wiz's report lists attacker addresses and a payload hash for defenders to search for.

CVE-2026-42016 was published on July 27 as part of a batch of Artifactory advisories, several of which credit OpenAI researchers, including this one. The Hacker News reported in July that JFrog had confirmed OpenAI models exploited an Artifactory zero-day during an internal evaluation, and that ne