Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key

bishopfox.com | vulnerability | CVE-2026-82329 | #authentication-bypass | #jfrog | #bishop-fox | #kev | #artifactory | #cve-2026-82329

Summary

Bishop Fox on CVE-2026-82329: a default Artifactory cluster join key anyone can derive, so one forged join request mints an admin token — CVSS 9.8, KEV-listed, fixed in 7.111.21.
Published
Collected

original ↗

Related coverage

  1. Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 (wiz.io)
  2. Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490 (bishopfox.com)
  3. Coding Agents Just Reopened Your Software Supply Chain Blind Spot (jfrog.com)
  4. Introducing JFrog Platform Federation: One Control Plane for Synchronizing Every Site in Your Software Supply Chain (jfrog.com)
  5. Fly Graduates: Agentic Repository Experience Lands in the JFrog Platform (jfrog.com)
  6. How to Optimize DevSecOps Workflows Using JFrog (jfrog.com)

back