Attackers Are Minting Admin Tokens From a Critical JFrog Artifactory Flaw

A Critical JFrog Artifactory Flaw Is Letting Attackers Mint Their Own Admin Tokens

A critical authentication bypass in JFrog Artifactory (CVE-2026-82329) is being exploited in the wild, and the attackers are using it to forge administrative access tokens on the artifact repositories that enterprise software delivery depends on. The flaw works in the default configuration of self-managed Artifactory instances, which means any unauthenticated attacker with network reach to the server can take full control of it.

For African enterprises this lands hard. South African banks, Nigerian fintechs and Kenyan payments platforms all run CI/CD pipelines built on repository managers exactly like this one. If your build servers pull from a compromised Artifactory, every artifact downstream carries the taint.

How the attack works

Artifactory is the storehouse where development teams keep the binaries, containers and packages their software is built from. The vulnerability lets a remote attacker skip authentication entirely and issue themselves admin tokens. watchTowr researchers observed attackers doing exactly that, minting admin tokens for themselves.

With that access an attacker can enumerate users and groups, read proprietary artifacts, change security configuration, and replace legitimate packages with poisoned ones. That last step is the nightmare scenario: your pipeline keeps building “successfully” while shipping attacker-controlled code into production.

Why patching alone doesn’t clean you up

Black Duck’s Collin Hogue-Spears pointed out something that will sting security teams who patched on August 28 and exhaled. JFrog treats access tokens as independent credentials with their own expiry and revocation. Upgrading the Artifactory binary does not invalidate a token an attacker already forged. Patching closes the door; it does not evict anyone already holding a key.

The full scope is unknown. JFrog’s advisory is light on detail, victim counts are unpublished, and there are no public indicators of compromise. BleepingComputer reached out to JFrog and had not received a response at publication of the source report.

What enterprises should do now

1. Patch to the fixed versions. Artifactory 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 close the hole. JFrog Cloud environments were already protected.
2. Revoke and rotate every access token. Assume tokens minted before the patch are hostile until proven otherwise. Audit token creation events for anything you don’t recognize.
3. Verify artifact integrity. Compare checksums and signatures on packages pulled during the exposure window. Treat unverified downloads from internal mirrors as suspect.
4. Restrict network reachability of the repository manager. An artifact store is not a public service. Put it behind VPN, segment it, and log everything touching it.

The supply chain is the soft underbelly of Africa’s digital economy

Continental fintech runs on velocity. Teams ship daily, dependencies flow through internal mirrors, and the repository manager rarely gets the scrutiny the payment switch next to it receives. This incident is a reminder that the build pipeline is production infrastructure. A critical auth-bypass flaw on the box that signs your software is a company-level event, not a devops ticket.

eHawu and the network layer of software supply chain defense

Every mitigations list for this incident converges on the same theme: shrink who can reach the Artifactory server, and watch what crosses the wire. That is a network-layer problem, and it is what eHawu was built for. eHawu’s VPN platform gives engineering teams AES-256-GCM encrypted, zero-knowledge tunnels with obfuscated routing and no logs, so repository managers and build infrastructure are never exposed to the open internet in the first place. An attacker who cannot reach the management interface cannot forge a token against it.

The question is no longer whether your artifact repository will be probed by someone hunting unpatched instances. It is whether anything they can reach is worth compromising. With eHawu, the answer is no.