# A phantom join key let anyone mint JFrog Artifactory admin tokens, and exploitation started in days

Source: https://startwithidentity.com/blog/2026-09-01-jfrog-artifactory-phantom-join-key-mints-admin-tokens/
Last updated: 2026-09-14
License: content by Start with Identity. Cite the source URL.

---

CVE-2026-82329 (CVSS 9.8) is an authentication bypass in JFrog Access, the component that issues Artifactory's tokens. Instances deployed without an additional join key configured received what researchers describe as a "phantom" join key, which an unauthenticated attacker can abuse to forge access, mint administrator-level tokens, and enumerate users, groups, and credential configuration. Affected builds span the 7.111.4, 7.117, 7.125, 7.133, 7.146, and 7.161 branches; the fix landed in 7.161.20 on August 28, 2026. Active exploitation began September 1, days after disclosure, with attackers observed creating backdoor accounts and mapping system topology in a limited number of cases.

## Why it matters

Artifactory is where an organization's binaries live, so administrator access is not the end of the intrusion, it is the position from which every downstream build inherits whatever the attacker publishes. That makes this a supply chain flaw wearing an [authentication](https://startwithidentity.com/guides/fundamentals/authentication-vs-authorization/) bug's clothes.

The specific failure is worth naming precisely, because it recurs. A secret that is supposed to be per-deployment defaulted to a value derivable by anyone, and the deployment still worked, so nobody noticed. That is the same shape as the [LiteLLM gateways still accepting `sk-1234`](https://startwithidentity.com/blog/2026-09-10-litellm-gateways-still-accept-the-example-admin-key/) and as the [Cisco FMC hardcoded credentials](https://startwithidentity.com/blog/2026-07-30-cisco-fmc-static-credentials-actively-exploited/) in July: a credential that is technically configurable, practically unset, and fully functional in its insecure state. A default that fails closed would have turned all three into support tickets instead of CVEs.

Patch to 7.161.20 or the fixed build in your branch. Then treat it as a credential incident rather than a patching one: enumerate admin accounts and access tokens created since late August, revoke and reissue them, rotate the repository credentials Artifactory holds for upstream registries, and check published artifacts against expected build provenance.

Source: [The Hacker News](https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html)