JFrog Artifactory: Three Chained Flaws Turn an Unauthenticated Request Into Admin — and a Rust Backdoor Survived the Patch

The short version//

JFrog Artifactory self-hosted is being walked into right now by unauthenticated strangers. Two flaws that were already patched chain together: CVE-2026-42018 leaks an internal anonymous-user JWT (even when you've disabled anonymous access), and CVE-2026-42016 lets that low-privilege token be exchanged for a full admin-scoped one. Wiz Research observed multiple actors running the chain between August 15 and September 8, with some attackers going from first request to a persistent admin account in under five minutes.

CISA added both CVEs to KEV on September 11 (catalog v2026.09.11), with a federal remediation due date of September 25. The third member of the family, CVE-2026-82329, has been in KEV since September 2 and is exploited too — more on it below, because it changes which version you need.

And here's the detail that makes this worse than "patch now": Wiz found a custom Rust backdoor with C2 capabilities dropped across multiple compromised instances — and per TechTimes' reporting, it survived patching. That's "reportedly" until JFrog says otherwise, but the operational lesson stands: upgrading alone is not proof of cleanliness.

The chain, in plain English//

Neither flaw wins on its own. Together they're a two-step elevator from "stranger on the internet" to "admin":

1. CVE-2026-42018 (CVSS 7.5, improper authentication) — an unauthenticated POST /access/api/v1/aws/token/ with a trailing slash returns HTTP 200 with a JWT for Artifactory's internal anonymous user. The trailing-slash variant slips past the access control applied to the standard path. This happens even when anonymous access is disabled — which is the part that stings, because "anonymous off" was the comfort setting most of us left on.
2. CVE-2026-42016 (CVSS 8.1, incorrect authorization) — Artifactory validates a token's signature and issuer but not its scope. Hand it the anonymous JWT via POST /access/api/v1/tokens and you get back a token carrying full admin scope.

The escalated token keeps the anonymous username, so every admin action shows up in logs as token:anonymous — a low-privilege identity doing high-privilege things. If your hunting instinct is "look for unexpected named accounts," you'll find nothing until you look for that instead. (Wiz's disclosure has the full request sequence and detection signatures.)

What the attackers did with admin access//

Wiz documented a consistent post-exploitation shape across compromised instances (no single actor ran every step — multiple crews were working the same exposure independently):

• Persistent admin accounts — created via PUT /api/security/users/<username>, some named to blend in (jfrog-distribution, repo-service), others straight out of a PoC (0xTerror, labadmin_<hex>).
• Malicious Groovy plugins — installed through Artifactory's legitimate plugin framework for arbitrary code execution on the server, then run via /api/plugins/execute/<plugin>.
• Droppers in world-writable paths — a binary fetched over plain HTTP written to /tmp, /dev/shm, or /var/tmp, with C2 established.
• The Rust backdoor — Wiz confirmed it across multiple instances; TechTimes reporting puts the implant at /tmp/.z (SHA1 513a907b69edffc3cb77a494da395178d21ef9bd) with delivery from log.gitclone[.]org:45678/smtp and C2 to 64.207.232[.]6:8443.
• Stolen cluster join keys — the shared secret nodes use to register with each other, valid until rotated. Steal it before you patch, and the attacker keeps a working credential after your upgrade.

Why does any of this matter beyond the box itself? Artifactory is where build pipelines pull their packages from. Whoever holds admin can read every artifact you ship, publish malicious packages under trusted coordinates that downstream builds install automatically, and grab the upstream credentials sitting in its config. Same "admin portal with a crown" pattern as our Gitea post and the Forgejo compromise postmortem, just bigger.

The numbers that should bother you//

• At CVE-2026-42016's publication on July 27, 67% of organizations running Artifactory had at least one vulnerable instance (Wiz data).
• Six weeks later, 59% were still vulnerable to it. CVE-2026-42018 went from 69% to 62% over four weeks. Patch velocity is glacial for a box this central.
• The campaign ran on installations where fixes already existed — JFrog shipped the 7.133-branch patch for CVE-2026-42018 on August 12, three days before Wiz saw the first chain exploitation on August 15. This is a patched-but-unpatched-by-you story, which is always the worst kind.
• TechTimes puts roughly 6,600 organizations on JFrog products (including 83% of the Fortune 100), per JFrog's own Q1 earnings — and notes an OpenAI backstory from July in which models exploiting an Artifactory zero-day surfaced during internal evaluation. That last one is secondhand; treat it as color, not fact.

CVE-2026-82329: the third leg you can't skip//

While you're patching for the chain, know that CVE-2026-82329 (CVSS 9.8) is also exploited and KEV-listed — added September 2, due September 5. Under default configuration, an unauthenticated POST /access/api/v1/registry/join returns an admin-scoped token in the response body. One request, no chain required. BishopFox's root-cause analysis describes the same class of flaw: the system checks whether a secret is well-formed rather than whether it actually exists.

What you should do//

1. Upgrade to your branch's fixed version — per JFrog's advisories: CVE-2026-42016 is scoped to Self Hosted < 7.133.11 (fixed in 7.133.11); CVE-2026-42018 fixed per branch at < 7.111.20; 7.117.0–>7.117.27; 7.125.0–>7.125.19; 7.133.0–>7.133.28; 7.146.0–>7.146.8; CVE-2026-82329 fixed at 7.111.21 / 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20. If you can pick freely, go to the latest release for your branch — one upgrade that clears all three beats three surgical ones.
2. If you were internet-reachable and unpatched between Aug 15 and Sep 8, assume compromise. Patching closes the door; it doesn't evict the tenant: audit admin accounts (including token:anonymous activity), revoke tokens issued since late August, rotate the cluster join key, and check /tmp/.z, Groovy plugins, and world-writable paths for the backdoor.
3. Hunt logs for the 401-then-200 pattern on /access/api/v1/aws/token/ — a 401 on the bare path followed by a 200 on a trailing-slash variant from the same client in a short window is Wiz's highest-confidence exploitation signature.
4. Disable anonymous access if it isn't already (it's off by default for new installs, but older boxes may have it on) — per JFrog's mitigation guidance, it narrows the blast radius even though 42018 leaks a token with it disabled anyway.
5. If you can't patch today, firewall the instance or front it with auth — an Artifactory that only your CI can reach is a much smaller target than one on port 8080 to the world.