Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key

bishopfox.com | vulnerability | CVE-2026-82329 | #authentication-bypass | #jfrog | #bishop-fox | #kev | #artifactory | #cve-2026-82329

Summary

Bishop Fox on CVE-2026-82329: a default Artifactory cluster join key anyone can derive, so one forged join request mints an admin token — CVSS 9.8, KEV-listed, fixed in 7.111.21.
Published
Collected

original ↗

Related coverage

  1. Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 (wiz.io)
  2. Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490 (bishopfox.com)
  3. JFrog Artifactory Supports LuaRocks Hosting for NGINX, OpenResty and Kong (jfrog.com)
  4. Coding Agents Just Reopened Your Software Supply Chain Blind Spot (jfrog.com)
  5. Introducing JFrog Platform Federation: One Control Plane for Synchronizing Every Site in Your Software Supply Chain (jfrog.com)
  6. Fly Graduates: Agentic Repository Experience Lands in the JFrog Platform (jfrog.com)

back