Attackers exploited two vulnerabilities in JFrog Artifactory, the repository used by software build pipelines, to gain administrator control of self-hosted servers and plant backdoors, according to a report from cloud security company Wiz This article explores vulnerabilities jfrog artifactory. . CVE-2026-42018 allows an internal anonymous-user token to be handed out to a caller without logging in, even when anonymous access is disabled.
This token can then be easily swapped for one with elevated administrative privileges, as Artifactory verifies the token's signature and issuer but not its permissions. JFrog shipped the CVE-2026-42018 fix on the 7.146 branch on April 28, and on the 7.133 branch on August 12, three days before the attacks Wiz observed started.
A dropper transferred a binary via HTTP, writing it to a world-writable directory like /tmp, and established a command-and-control channel. For CVE-2026-82329, JFrog publishes a workaround for anyone who cannot upgrade quickly: generate a random value and add it as an extra join key in system.yaml, so that only your own keys are accepted when a service registers. Fastly suggests rotating the platform join key, revoking access tokens issued since August 28, and reviewing administrator accounts, repositories, and configuration changes.
The clearest indicator is an account attempting actions beyond its assigned privileges: an internal anonymous user or a low-privilege account creating tokens, listing users, or accessing or modifying plugins.
