CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key

CVE

CVE-2026-82329

Published

2026-09-11 00:00

Collected

2026-09-11 18:22

---
id: 7573
title: "CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key"
cve: CVE-2026-82329
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/cve-2026-82329-unauthenticated-administrative-access-in-jfrog-artifactory-via-an-empty-cluster-join-key"
published_at: "2026-09-11T00:00:00Z"
tags: ["authentication-bypass", "jfrog", "bishop-fox", "kev", "artifactory", "cve-2026-82329"]
phying_url: "https://phying.com/item/7573"
lang: en
---

# CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key

## Summary

Bishop Fox on CVE-2026-82329: a default Artifactory cluster join key anyone can derive, so one forged join request mints an admin token — CVSS 9.8, KEV-listed, fixed in 7.111.21.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2026-82329
- **Published:** 2026-09-11T00:00:00Z
- **Original:** https://bishopfox.com/blog/cve-2026-82329-unauthenticated-administrative-access-in-jfrog-artifactory-via-an-empty-cluster-join-key
- **Phying News:** https://phying.com/item/7573