The Default Join Key That Let Attackers Mint Admin Tokens on JFrog Artifactory

Artifactory's Default Configuration Vulnerability

JFrog disclosed on August 28, 2026 that a default configuration in self-hosted Artifactory instances is vulnerable to an authentication bypass. By default, the join key used by Artifactory's access layer to verify cluster members is an empty string. This flaw, identified as CVE-2026-82329, allows an unauthenticated attacker to generate a forged JWT, sign it with the predictable value, and use it to obtain administrator privileges.

The flaw, tracked as CVE-2026-82329, carries a CVSS v3.1 score of 9.8, classifying it as a critical severity vulnerability. Attackers began exploiting it within days of the disclosure. The vulnerability stems from the default configuration shipped with Artifactory, which leaves the join key empty. When the signing-key lookup is called with an empty value, it returns a predictable 32-byte result, enabling an attacker to forge a legitimate-looking join JWT.

Once an attacker obtains a valid administrator token, they can perform various malicious actions. They can replace cached packages with tampered dependencies, abuse published credentials, modify build pipelines, and even execute arbitrary code, create persistent accounts, and exfiltrate sensitive data. The impact extends beyond the affected Artifactory host, as any vulnerable instance connected to the network should be treated as compromised.

JFrog addressed two related issues in conjunction with this vulnerability. CVE-2026-42018 allows an unauthenticated caller to obtain an anonymous user token, even when anonymous access is disabled. CVE-2026-42016 enables a low-privilege token to be used for privilege escalation. These issues, when combined with the authentication bypass, create a significant zero-trust problem.

Collin Hogue-Spears of Black Duck emphasized that the compromise of Artifactory access reaches downstream systems consuming the published artifacts without further review.