Attackers Chain Two JFrog Artifactory Flaws to Mint Admin Tokens and Plant Rust Backdoors
TL;DR what: Attackers chained CVE-2026-42018 and CVE-2026-42016 in self-hosted JFrog Artifactory to turn an unauthenticated request into an administrator-scope token, then installed Groovy plugins and Rust backdoors. impact: Compromised servers gave up administrator accounts, code execution, command-and-control channels, and in several cases the cluster join key that Artifactory nodes use to…
Attackers exploited two previously patched vulnerabilities in self-hosted JFrog Artifactory to gain administrator access and install malicious software. The first flaw, CVE-2026-42018, allows unauthenticated requests to be converted into administrator tokens, even when anonymous access is disabled. The second flaw, CVE-2026-42016, enables low-privilege tokens to be upgraded to administrator scope.
Once attackers obtained these administrator tokens, they installed Groovy plugins and a Rust backdoor to establish command-and-control channels and gain further control over compromised servers. The impact of this attack includes compromised administrator accounts, code execution, and command-and-control capabilities, as well as the potential to join Artifactory clusters.
To fix the vulnerabilities, users must upgrade to the appropriate patched version for their release branch and rotate the cluster join key while revoking any tokens issued since August 28.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
