{
  "id": 8584791,
  "title": "The Default Join Key That Let Attackers Mint Admin Tokens on JFrog Artifactory",
  "url": "https://urgent.news/2026/09/20/the-default-join-key-that-let-attackers-mint-admin-tokens-on-jfrog",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-20T01:40:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/bianliang/the-default-join-key-that-let-attackers-mint-admin-tokens-on-jfrog-artifactory-1b5l"
  },
  "original_language": "en",
  "account": "Artifactory's Default Configuration Vulnerability\n\nJFrog disclosed on August 28, 2026 that a default configuration in self-hosted Artifactory instances is vulnerable to an authentication bypass. By default, the join key used by Artifactory's access layer to verify cluster members is an empty string. This flaw, identified as CVE-2026-82329, allows an unauthenticated attacker to generate a forged JWT, sign it with the predictable value, and use it to obtain administrator privileges.\n\nThe flaw, tracked as CVE-2026-82329, carries a CVSS v3.1 score of 9.8, classifying it as a critical severity vulnerability. Attackers began exploiting it within days of the disclosure. The vulnerability stems from the default configuration shipped with Artifactory, which leaves the join key empty. When the signing-key lookup is called with an empty value, it returns a predictable 32-byte result, enabling an attacker to forge a legitimate-looking join JWT.\n\nOnce an attacker obtains a valid administrator token, they can perform various malicious actions. They can replace cached packages with tampered dependencies, abuse published credentials, modify build pipelines, and even execute arbitrary code, create persistent accounts, and exfiltrate sensitive data. The impact extends beyond the affected Artifactory host, as any vulnerable instance connected to the network should be treated as compromised.\n\nJFrog addressed two related issues in conjunction with this vulnerability. CVE-2026-42018 allows an unauthenticated caller to obtain an anonymous user token, even when anonymous access is disabled. CVE-2026-42016 enables a low-privilege token to be used for privilege escalation. These issues, when combined with the authentication bypass, create a significant zero-trust problem. Collin Hogue-Spears of Black Duck emphasized that the compromise of Artifactory access reaches downstream systems consuming the published artifacts without further review.",
  "summary": "The Default Join Key That Let Attackers Mint Admin Tokens on JFrog Artifactory A package repository that hands out administrator credentials to an unauthenticated caller is a supply-chain problem, not a web-application problem. That is the situation JFrog disclosed on 28 August 2026 for self-hosted Artifactory instances, and by 1 September attackers were already using it in the wild. What the…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}