Attacks on JFrog Artifactory: A Flaw Chain Opens the Path to Admin Rights

Wiz, a company specializing in cloud security, has reported a series of attacks on JFrog Artifactory — the repository from which developers' build pipelines pull components. The attackers chained two vulnerabilities to seize administrative control over self-hosted servers and leave backdoors on them. The attacks were observed between August 15 and September 8; JFrog had closed both holes ahead of time, so only un-updated systems came under fire.

How the Chain Works

On its own, neither vulnerability grants administrator rights. CVE-2026-42018 forces Artifactory to hand out the internal token of the anonymous user to someone who has not authenticated at all — even when anonymous access is disabled. Then CVE-2026-42016 makes it possible to exchange that low-privilege token for one with an administrative scope: the system verifies the token's signature and who issued it, but not what that token is allowed to do.

Every case looked the same: an unauthenticated request to the token-issuing endpoint, receipt of an anonymous token, and its exchange for an administrative one. The second token keeps the name anonymous, so the administrator's actions show up in the logs as token:anonymous rather than under a specific account. Sometimes the path from the first request to a new administrator account took less than five minutes.

What the Attackers Did

Once they had the rights, the attackers created and left behind administrator accounts, installed malicious Groovy plugins through Artifactory's built-in extension mechanism (this gave them code execution on the server), and ran shell commands. A dropper would download a binary over HTTP into a writable directory such as /tmp and open a control channel; in several cases Wiz saw a custom Rust backdoor with command-and-control features.

The Third Hole

Separately, from September 1 to 8, the critical CVE-2026-82329 (a CVSS score of 9.8) was exploited — an authentication bypass that requires no other vulnerabilities and works on the default configuration all the way up to the 7.161 branch. A public exploit appeared on September 1; Fastly counted about 406,000 exploitation attempts on September 2. CISA added the vulnerability to its Known Exploited catalog on September 2, with a deadline for federal agencies of September 5. On servers taken over through it, the attackers read the configuration and in a number of cases grabbed the cluster join key — the shared secret for registering nodes.

What an Update Won't Fix

Updating does not remove the administrator accounts that were created, nor does it revoke tokens that have already been issued. Fastly advises treating any exposed server as compromised: rotate the join key, revoke tokens issued since August 28, and check accounts, repositories, and configuration changes. A warning sign is an anonymous or low-privilege user creating tokens or working with plugins, as well as administrators with names like 0xTerror or ones masquerading as service accounts (jfrog-distribution, repo-service).

Curiously, CVE-2026-42016 was published on July 27 among a set of fixes, some of which were credited to OpenAI researchers: it had previously been reported that OpenAI's models discovered a zero-day in Artifactory during an internal review.

Source: The Hacker News