Originally published at HOL
BREAKING: JFrog Artifactory unauth admin on default config
JFrog published CVE-2026-82329 today as Critical (CWE-287). The advisory text is one sentence: under default configuration, an unauthenticated attacker with network access may obtain administrative privileges on Artifactory. Cloud is already patched. Self-hosted is not. The operator trap is Tuesday's patch. 7.161.19 and 7.146.36 shipped on 25 August 2026 for a different set of CVEs. Those builds are still in today's affected ranges. You need 7.161.20 or 7.146.38, or the matching build on the other four trains.
Who is not in scope
Taken from the JFrog advisory and the 28 August 2026 self-managed release notes, not invented.
- JFrog Cloud. The advisory says affected Cloud environments have already been fortified. No action is required for cloud instances.
- A self-hosted node already on 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. Those are the six patched versions JFrog listed in How to Fix.
- The advisory table only names six 7.111 through 7.161 trains. It does not list 7.104 or older, and it does not list JFrog SaaS as still open.
The 7.111 row starts at 7.111.4, not 7.111.0. JFrog did not publish a statement about trains below 7.111.4. Do not treat silence as a free pass, and do not invent that those trains are patched.
What this is not
This is not a JFrog Cloud emergency. It is not remote code execution. The vendor impact is administrative privileges, not a claimed shell. It is not CVE-2026-66014 (the 27 July 2026 High for HA authentication fail-open). It is not CVE-2026-42018 (the 12 August 2026 High that could return an internal anonymous-user token when anonymous access is disabled). It is not the 27 July 2026 security notice about chaining bugs when Anonymous Access is on. That notice said Anonymous Access is disabled by default. Today's advisory says default configuration is enough. That is a different bar. This is not a CISA KEV listing as of this writing. NVD has not published analysis yet.
What broke
Vendor description, quoted in full because that is all they gave: JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. Severity is Critical. Weakness is CWE-287 Improper Authentication. Published and updated 28 August 2026.
Self-managed release notes for 7.161.20 and 7.146.38 are dated 28 August 2026. Both say the patch is a security bug fix and strongly recommend the upgrade. Component column is General. Tuesday's 7.161.19 (25 August) fixed CVE-2026-70551, CVE-2026-70550, CVE-2026-70548, and CVE-2026-69104. Tuesday's 7.146.36 fixed the first three of those. Neither Tuesday build is the 82329 fix.
Affected ranges as JFrog printed them (their greater-than mark means through):
- 7.161.0 through 7.161.19, patched 7.161.20
- 7.146.0 through 7.146.36, patched 7.146.38
- 7.133.0 through 7.133.28, patched 7.133.29
- 7.125.0 through 7.125.19, patched 7.125.20
- 7.117.0 through 7.117.27, patched 7.117.28
- 7.111.4 through 7.111.21, patched 7.111.21
That last row is inconsistent on the page: the affected column includes 7.111.21 and the patched column is also 7.111.21. Treat the How to Fix list as the source of truth. JFrog named 7.111.21 as a fixed version. If you are on 7.111.20 or lower on that train, you are in the affected range either way.
Operator check
JFrog documents GET /artifactory/api/system/version as the version endpoint (since 2.2.2). Official docs say it requires a valid user and can be anonymous. Confirm version against the six patched builds:
jf rt curl /api/system/version
You want one of: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20. If the JSON says 7.161.19 or 7.146.36, you applied Tuesday's patch and you are still on today's affected list. If you run a multi-node cluster, check every node. JFrog also documents that the product version from this API can differ from an individual microservice version on /artifactory/api/system/nodes; use the product version for this advisory.
How to fix
Upgrade self-hosted Artifactory to the patched build on your current train:
- 7.161.x to 7.161.20
- 7.146.x to 7.146.38
- 7.133.x to 7.133.29
- 7.125.x to 7.125.20
- 7.117.x to 7.117.28
- 7.111.x (from 7.111.4) to 7.111.21
Take the bits from JFrog's self-managed release notes and the usual upgrade path. Stay on your train. Do not invent a workaround. JFrog did not publish one. After upgrade, re-run the version API and require an exact match on one of the six patched strings.
If the HTTP API is reachable from outside your admin network, restrict that path now. The advisory requires only network access and default configuration. That is enough reason to stop leaving the UI and REST surface on the public internet while you patch.
This article is the operator write-up. The HOL Guard evidence page is the source record for CVE-2026-82329.
