Security1 publisher2 min readPublished
Scanning for CVE-2026-82329 hit 406,000 attempts five days after JFrog disclosed it
One HTTP request to an unauthenticated cluster-join endpoint returns a non-expiring Artifactory admin token, and Fastly logged the volume going from single-digit probes to indiscriminate spraying in five days.
The Watch · Security desk
What happened
- CVE-2026-82329 is a CVSS 9.8 unauthenticated bypass in self-hosted JFrog Artifactory that lets an anonymous caller mint a full platform admin access token with one HTTP request.
- The JFrog Access service splits its trusted cluster join-key configuration on commas without dropping empty entries, and on a default install that value is empty, so an empty key is trusted.
- Origins of the traffic grew from a few IP addresses to nearly 1,400 inside a single day once a proof of concept was public and the tooling was commoditized.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Registry admin reaches stored credentials, user and repository creation, and published artifacts, so every consumer of those builds is downstream of one unauthenticated request.
- decision Operators who were unpatched on September 1 and 2 have to decide between a patch-and-close ticket and a token hunt, because the minted platform token does not expire on its own.
- capability Detection costs a log query: one fixed hash value in the kid field, no behavioural baseline and no vendor telemetry required.
- precedent The volume tracked the public exploit rather than the advisory. The practical remediation window for the next deterministic-secret bug is days, not the 30 Microsoft budgets for its own exploited CVEs.
The forged JWT is not the prize. Presenting it to `POST /access/api/v1/registry/join` mints a service-scoped admin access token, and that token is then exchanged for a full admin platform token that does not expire [7]. Patching the Access service fixes the bypass, and a token an attacker minted on September 2 stays valid.
The signing secret for the empty join key is a fixed 32-byte value derived from empty input, so the HS256 signature is reproducible by anyone [5]. The forged token's key ID is the SHA-256 of the empty string, e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 [6]. A real cluster peer hits the same method and path but signs with a non-empty join key, so its kid is a different hash [8]. Both get an HTTP 201 back, which is why Fastly points at the pairing: a 201 associated with that empty-string key ID is, in its words, high-confidence evidence of compromise [9].
Add Fastly's three days of counts. Roughly 75,000 attempts on August 31, most of them from offensive security services [11]; just above 171,000 on September 1, the day a public exploit landed [12]; around 406,000 on September 2 [13]. That is about 652,000 attempts in 72 hours [20], with September 2 running some 5.4 times August 31 [21]. These are attempts seen across Fastly's platform, not confirmed compromises [22].
Disclosure did not move the graph. August 28 produced no detected activity, and August 29 and 30 produced single-digit probes [10]. The public exploit set the clock, and the peak came five days after JFrog's advisory [19]. By then the origin count had gone from a handful of IPs to nearly 1,400 inside a day [15], with individual IPs spraying thousands of distinct hosts [14].
What makes the token hunt worth doing is what the registry holds. Artifactory is one of the most widely deployed enterprise binary and package repositories [16], and registry admin means stored credentials, arbitrary user and repository creation, and tampering with published artifacts [17]. Only self-hosted instances are in scope [1]. Fastly has shipped a Next-Gen WAF virtual patch and still tells customers to patch the software [18].
What to watch
- Whether Fastly's threat-actor analysis names organised groups behind the September 1-2 spraying or leaves it as commodity scanning.
- Whether any organisation reports a tampered published artifact or a stolen registry credential traced to CVE-2026-82329.
- Whether attempt volumes after September 2 hold at scanning levels or fall away as reachable unpatched instances are exhausted.