Attackers Exploit Critical JFrog Artifactory Flaw CVE-2026-82329 to Forge Admin Tokens and Poison CI/CD Pipelines
A critical vulnerability identified as CVE-2026-82329 in JFrog Artifactory is being actively exploited by attackers to generate administrator tokens without authentication on self-managed deployments that use default configuration settings.
The flaw permits an unauthenticated attacker who has network access to the instance to issue or forge admin tokens, resulting in immediate administrative privileges. Once inside, the intruder can enumerate users, groups, and credential sets, inspect sensitive configurations, and gain visibility into federated topologies.
Attackers can also read stored artifacts and alter security settings. This combination is especially dangerous in organizations that rely on Artifactory as the central component of their software build and publication lifecycle.
The most damaging scenario occurs when the repository automatically supplies artifacts to CI/CD tools and deployment systems. By substituting a trusted internal package, container image, or dependency, an attacker can propagate malicious changes through build runners into production environments, creating a classic supply-chain compromise with a single point of entry affecting multiple downstream systems.
JFrog Cloud instances were already protected. For on-premises deployments, administrators must update to one of the following patched versions: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Applying the patch is insufficient if tokens have already been issued, because token validity, expiration, and revocation operate independently of the binary update.
Recommended actions include prioritizing internet-exposed instances, restricting network access, revoking and reissuing administrator tokens, reviewing token expiration policies, and rotating credentials linked to pipelines and systems that authenticate against the repository. Security teams should also examine audit logs for anomalous token creation, mass user and group enumeration, configuration changes, and unusual administrative API access.
Organizations that kept the service exposed during the vulnerable window should treat the environment as potentially compromised. This requires validating the integrity of all artifacts published during that period and checking for substitutions. Additional hardening measures include pinning images to immutable digests and verifying signatures and provenance at deployment time.
Related articles
Protestware: How Ideologically Motivated Attackers Compromise Open Source Code and Supply Chains
Protestware represents a growing supply chain risk where open source maintainers deliberately insert destructive or politically motivated code into widely used packages. Unlike traditional malware seeking financial gain, protestware is driven by ideological motives and can delete files, cause denial of service, or restrict functionality based on geography or locale. Notable incidents include the node-ipc and peacenotwar packages that overwrote files on systems in Russia and Belarus, the colors.js infinite loop causing DoS, and es5-ext triggering high CPU usage during specific hours or Russian locales. These attacks often hide in postinstall hooks, use geolocation checks via ipinfo.io, or activate via environment variables and timestamps. Detection requires static analysis for geo-IP logic, dynamic monitoring in sandboxes, and tools such as Software Bill of Materials and OpenSSF Scorecard. Organizations are advised to adopt Zero Trust for dependencies, pin versions, use internal artifact repositories, and follow frameworks including NIST SSDF and SLSA to mitigate risks.
Critical JFrog Artifactory Flaw CVE-2026-82329 Actively Exploited to Forge Admin Tokens in Self-Managed Deployments
A critical vulnerability identified as CVE-2026-82329 in JFrog Artifactory is being actively exploited in the wild, enabling unauthenticated attackers to generate or forge administrator tokens simply by having network access to affected instances. The flaw impacts self-managed installations that retain default configurations, a common scenario when repositories are deployed quickly and later exposed to the internet. Once administrative access is obtained, attackers can enumerate users and groups, access sensitive configurations, read stored artifacts, and modify security settings. The most severe risk arises when Artifactory automatically feeds CI/CD pipelines, allowing malicious substitution of trusted packages, container images, or dependencies that then propagate downstream into production environments. JFrog Cloud instances were already protected, while self-managed deployments require updates to specific patched versions including 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Even after patching, previously issued tokens must be revoked because their validity operates independently of the software update. Organizations are advised to restrict network exposure, rotate credentials, audit token generation logs, and validate artifact integrity for any material published during the vulnerable period.
Unicode Tricks Let Malicious Python Code Bypass Code Review
A detailed analysis shows how subtle Unicode manipulations allow code to pass human review while executing entirely different logic. The first technique replaces Latin characters with visually identical Cyrillic or other script letters inside identifiers, such as using Ukrainian 'і' instead of Latin 'i' in an is_admin variable. Python treats these as distinct names because NFKC normalization does not map Cyrillic to Latin. The second technique inserts bidirectional override characters that reorder text for the compiler while the editor displays the intended order. The third hides zero-width characters inside string literals to break comparisons and searches. A compact Python auditor using the tokenize module and explicit character sets detects all three classes of characters. The article recommends adding such checks to CI pipelines and configuring linters including ruff and flake8 to reject suspicious commits.
redb 3.7.2 Released with Custom gRPC Protocol, Dependency Vulnerability Fixes and .NET 10 Migration
The redb ecosystem released versions 3.7.0, 3.7.1 and 3.7.2 in quick succession after 3.7.0 was withdrawn due to high-severity vulnerabilities in its .NET 9 build artifacts. NuGet audit detected issues only on full rebuilds, leading to updates for SSH.NET, Microsoft.Data.Sqlite, System.Security.Cryptography.Xml and Microsoft.Bcl.Memory across redb.Route, redb.Core, redb.Export and redb.Identity. The release introduces a native GrpcWire implementation that registers individual gRPC methods as routes on a shared Kestrel host, supports bidirectional streaming, real gRPC status codes and mTLS with pinned client certificates. redb.Route also gained a dedicated SOAP connector, Control Bus messaging for route lifecycle management and a corrected Claim Check pattern. File transports received critical fixes that prevent silent data loss when readLock and idempotency options are combined. All libraries now target net8.0;net9.0;net10.0 while host applications require .NET 10, aligning with Microsoft’s shortened support timeline for .NET 8 and 9.