Attackers Are Minting Admin Tokens in JFrog Artifactory—Here's What to Do

Robert Moore · 2026-09-01

It took just days. That's the window between JFrog releasing a patch for a critical vulnerability and threat actors actively exploiting it in the wild. Security researchers at [watchTowr](https://labs.watchtowr.com) flagged the issue, and the news isn't good for anyone running an unpatched instance of Artifactory. The flaw, tracked as CVE-2026-82329, carries a CVSS score of 9.8 out of 10. That's about as severe as it gets. At its core, this is an authentication bypass—a nasty bug that lets an attacker trick the system into thinking they're an admin without needing valid credentials. In plain English? If you're running Artifactory and haven't applied the latest update, someone could walk right past your login page and grab the keys to the kingdom. ### What Does This Flaw Actually Do? Here's the scary part: the vulnerability isn't some obscure edge case that requires a specific setup. According to the advisory, "JFrog Artifactory contains an authentication weakness that, under default configurations, can be exploited to achieve administrative access." That means the default install—the one most teams are running—is vulnerable. An attacker who exploits this can: - Mint admin tokens for persistent access - Read and modify any artifact stored in your repositories - Inject malicious code into packages that your development teams will later pull - Exfiltrate sensitive data, including credentials and proprietary code The token minting part is particularly sneaky. Instead of just breaking in once, attackers create their own admin tokens. That gives them a backdoor that survives password changes and even some security tooling. ### Why This Matters for Your Supply Chain You might be thinking, "We're a small team—why would anyone target us?" But here's the thing: attackers aren't just going after big enterprises. They're going after anyone who uses Artifactory because it's a perfect supply chain attack vector. Think about it. Artifactory is where you store the building blocks of your applications. If an attacker compromises that, they can poison the well. Your developers download what they think is a trusted library, but it's actually been tampered with. That code then gets shipped to your customers. It's a classic supply chain attack, and we've seen how devastating those can be. Remember the SolarWinds breach? Same concept, different tool. ### What You Should Do Right Now If you're running JFrog Artifactory, here's your action plan: 1. **Update immediately.** JFrog has released a patch. Don't wait for your usual maintenance window. This one is urgent. 2. **Check for existing compromise.** Look for any admin tokens that you didn't create. Audit your user accounts and remove anything suspicious. 3. **Review your audit logs.** JFrog keeps logs of administrative actions. If you see anything odd—like new users created or permissions changed—investigate. 4. **Rotate credentials.** Even if you don't find evidence of a breach, change your admin passwords and revoke existing tokens. Better safe than sorry. ### The Bigger Lesson The speed of this exploitation—days after disclosure—is a reminder that the window for patching critical vulnerabilities is shrinking. Attackers now have automated tools that scan for newly disclosed CVEs and immediately try to exploit them. You can't afford to treat security patches as a quarterly chore. For critical flaws like this one, the timeline is measured in hours, not weeks. If you're using Artifactory in your CI/CD pipeline (and most teams are), take this seriously. The cost of a breach—both in dollars and reputation—far outweighs the inconvenience of an emergency patch. Stay safe out there, and keep your software current. It's the simplest thing you can do, and it's often the most effective.