Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure

Threat actors are actively exploiting a critical authentication bypass vulnerability, CVE-2026-82329, in JFrog Artifactory to gain administrative privileges and mint admin tokens. The flaw exists in default configurations of JFrog Access and allows unauthenticated attackers with network access to forge credentials. Exploitation began within days of public disclosure, enabling attackers to enumerate users, groups, and federated access topologies, posing significant risk to software supply chains. Organizations are urged to patch affected versions immediately and rotate exposed credentials.

AI-extracted · verify before operational use