CVE-2026-82329 is a critical (CVSS 9.8) unauthenticated authentication bypass in self-hosted JFrog Artifactory that lets an anonymous attacker mint a full platform admin access token with a single HTTP request. Since the vulnerability was disclosed on August 28, 2026 by JFrog, Fastly's threat research team has observed traffic associated with this CVE across our global platform go from initial low-level probing to opportunistic mass scanning.
To help mitigate exploitation attempts, Fastly Next-Gen WAF has shipped a virtual patch for CVE-2026-82329 allowing customers to protect their instances immediately. For remediation steps and vendor patching details, see the Actionable Recommendations section at the end of this post. We strongly encourage all customers to patch their systems immediately to address this critical vulnerability.
Background
JFrog Artifactory is one of the most widely deployed enterprise binary and package repositories, holding build artifacts for a large share of software producing organizations. That makes it a high-value target. An attacker who gains admin control of an artifact registry sits directly in the software supply chain allowing them to access stored credentials, create users and repositories, and tamper with published artifacts.
The vulnerability
CVE-2026-82329 (CWE-287, Improper Authentication) lives in the JFrog Access service that fronts Artifactory. When Access builds the set of trusted cluster "join keys" it is willing to verify signatures against, it splits a configuration string on commas without filtering empty entries. On a default install, that configuration value is empty, so an empty string is inserted as a trusted join key.
The empty key is crucial because its signing secret is fully deterministic; it’s a fixed 32-byte value derived from empty input. Any attacker can therefore forge a valid HS256 "join" JWT signed with that known secret. The forged token carries a key ID (kid) equal to the SHA-256 of the empty string:
kid = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 // SHA256("")Presenting that token to the unauthenticated cluster-join endpoint mints a service scoped admin access token, which is then exchanged for a full admin, non-expiring platform token. The entire chain begins with one request:
POST /access/api/v1/registry/join HTTP/1.1
Host: artifactory.example
Content-Type: application/json
{"token":"<forged HS256 JWT, kid = SHA256(\"\")>", ...}A legitimate cluster peer hits the same method and path, but signs with a real (non-empty) join key, so its kid is a different hash. That single discriminator, the empty-string kid is what separates an attack from normal inter-node traffic.
A successful exploitation attempt is distinct from legitimate inter-node traffic. While the unauthenticated join endpoint returns an HTTP 201 in both cases, the attack relies on a forged token using a specific, deterministic key ID (the SHA-256 hash of an empty string). Therefore, observing an HTTP 201 response associated with this specific key ID is high-confidence evidence of compromise.
Threat Activity
Following public disclosure of the vulnerability by JFrog, exploitation attempts tracked a standard weaponization pattern, experiencing a sharp surge as soon as a public exploit became available. No exploitation activity was detected on disclosure day (August 28), and overall volume remained minimal over the subsequent 48 hours, recording only single-digit probes across August 29 - 30. Initial notable activity emerged on August 31 with approximately 75,000 attempts, though offensive security services accounted for most of this volume. Escalation intensified significantly on September 1 following the release of a public exploit, driving attempts just above 171,000. Activity reached its peak on September 2 at around 406,000 attempts, marking the highest concentration of unique origin countries and attacking IP addresses throughout the observed timeframe.
Two things stand out beyond the volume curve.
First, the breadth of targeting: On September 1 and 2, individual IPs each sprayed across thousands of distinct hosts indiscriminately, scanning rather than performing targeted attacks.
Second, attack origins expanded rapidly, growing from a few initial IPs to nearly 1,400 within a single day. Traffic quickly spread once the PoC was public and the tooling was commoditized.
The Threat-Actor Landscape
Analysis of the exploitation traffic observed across our global platform from August 28 through September 2, 2026, reveals three primary categories: initial offensive security testing, followed by two distinct threat-actor operational tiers, mass scanning and targeted exploitation attempts.
Early Activity: Offensive Security Research and Testing
Initial traffic recorded on August 31 could easily be mistaken for the onset of malicious mass exploitation. However, offensive security vendors and research services accounted for nearly 98% of the volume that day (roughly 73,000 out of ~75,000 total requests) across most originating IPs. By September 1, research and vendor activity subsided to negligible levels as actual exploitation became the dominant driver of traffic.
Tier 1: High-Volume Mass Scanning
Broad, automated scanning constitutes the vast majority of attack traffic. Between approximately 16:40 and 19:48 UTC on September 1, a coordinated set of rented VPS instances across hosting networks in France and the United States aggressively targeted the join endpoint. Over this roughly three-hour window, each source host probed thousands of separate systems using the User-Agent string JFrogArtifactory/7.146.25 (corresponding to a known vulnerable build). This activity escalated on September 2, when we observed a single VPS provider generating the majority of the day's total attempts during an extended evening surge directed at thousands of targets without pre-filtering for active Artifactory deployments.
Tier 2: Targeted Exploitation
In contrast to the high-volume sprayers, a smaller group of deliberate actors engaged in targeted exploitation attempts. Several of these sources utilized the default User-Agent provided by the public proof-of-concept exploit: jfrt/0/7.161.19. While these specialized actors generated significantly lower request volumes, their activity reflected precise knowledge of the underlying vulnerability.
Actionable recommendations
Patch now. Upgrade self-hosted Artifactory to a fixed build: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20 (whichever matches your branch).
Assume compromise if you were exposed. A patch does not revoke tokens already minted. Rotate the platform join key, revoke access tokens issued since August 28, 2026, and audit for unexpected admin users, repositories, and configuration changes.
Virtual-patch. Fastly Next-Gen WAF customers should enable the CVE-2026-82329 templated rule.
Hunt your logs. Search for any request to the join endpoint, and treat an HTTP 201 response as a confirmed compromise. The attacker User-Agents in the Indicators of Compromise (IOC) list are a cheap first filter, but do not rely on them alone, they are trivially changed.
Conclusion
CVE-2026-82329 is a compact case study in how fast the modern exploitation pipeline moves. A critical, unauthenticated bug in a supply chain central product went from disclosure to internet scale scanning in roughly 72 hours and to confirmed compromise the moment a public PoC appeared. The defensive takeaways are unglamorous but effective: patch quickly, treat exposure as a compromise until proven otherwise, and deploy a virtual patch to buy time. Fastly will continue to monitor activity in relation to this CVE.
Indicators of compromise (IOCs)
Endpoint Variants:
POST /access/api/v1/registry/join
POST /access/api/v1/registry/join/router
POST /access/api/v1/registry/join/router?override=true
Payload indicator: JWT kid = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Success signal: HTTP 201 from those endpoints
User-Agents:
jfrt/0/7.161.19
JFrog-Access/7.141.17
JFrogArtifactory/7.146.25
High-volume source IPs (sample):
213.136.72[.]87, 89.117.49[.]147, 45.33.75[.]219, 23.92.20[.]11, 173.255.226[.]148, 195.154.157[.]234, 62.210.87[.]212, 45.79.190[.]169, 163.172.132[.]245
References
Official advisory from JFrog: JFrog Security Advisories
Fastly Virtual Patch documentation: Virtual Patch for CVE-2026-82329
Nuclei detection template: Nuclei template for CVE-2026-82329
Fastly Security Research publications: Fastly Security Research