Skip to content

Back to the catalog

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
wiz.ioadvisory

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Wiz Research documents active in-the-wild exploitation of three JFrog Artifactory vulnerabilities: CVE-2026-42018 (exposes an internal anonymous-user JWT via POST /access/api/v1/aws/token/), CVE-2026-42016 (token scope validation flaw allowing that JWT to be escalated to admin via POST /access/api/v1/tokens), and CVE-2026-82329 (unauthenticated admin access via POST /access/api/v1/registry/join, added to CISA KEV). Attackers chained the first two to create persistent admin accounts, deploy malicious Groovy plugins for RCE, and drop Rust-based C2 backdoors, while CVE-2026-82329 was exploited independently for configuration exfiltration, cluster join-key theft, and credential/SSH-key persistence. The post includes exact request sequences, detection signatures, affected/fixed version ranges, and remediation guidance.

TL;DR Wiz details in-the-wild chaining of CVE-2026-42018+CVE-2026-42016 and standalone exploitation of CVE-2026-82329 to gain admin control of JFrog Artifactory, with Rust backdoors, Groovy plugin RCE, and full detection/IOC guidance.
Open original ↗
Document

What it is

Wiz Research's report on active, in-the-wild exploitation of three JFrog Artifactory flaws — CVE-2026-42018 (leaks an internal anonymous-user JWT), CVE-2026-42016 (token scope-validation flaw for privilege escalation), and CVE-2026-82329 (unauthenticated admin access, on CISA KEV). Beyond the summary, the page gives fixed versions, six recovered post-exploitation plugins with their internals, IOC hashes/usernames, behavioral detections, and — critically — why upgrading alone does not evict an attacker.

The point the summary misses

Patching closes the entry point but leaves persistence intact. Groovy user plugins live in $JFROG_HOME/var/etc/artifactory/plugins/, run unsandboxed in the Artifactory JVM, and reload on restart. Worse, several plugins steal the Access private.key that signs tokens; whoever holds it can forge valid tokens for any user/scope indefinitely, offline, and patching does not revoke it. Any instance found with these plugins needs its token certificate reset, not just an upgrade.

Plugins to hunt for

  • rce.groovy / cmd.groovy / jwtToken.groovy (uploadFile.groovy) — command shells; jwtToken declares users: ['anonymous','admin'] so it runs unauthenticated post-patch.
  • JFrogImage.groovy — exfil toolkit (e=1 config secrets, u=1 user/token DB dump, k=1 Access signing keys). Returns output via a thrown RuntimeException in an HTTP 500 errors[0].message field — detections keying on 2xx miss it.
  • metrics.groovy — in-memory Tomcat servlet filter traceFilter; executes bodies when X-Request-Trace MD5 = a993c4553636e1606e0072a5eb1ed6f0, and rejects (HTTP 400) requests lacking X-Trace-Pass MD5 4948ebd2d809972d9c60751011b0492f to registry/join, api/plugins, or systemUpload — locks out rivals and admins. A mysteriously broken plugin API is itself an IOC.
  • httpSession.groovy — disguised as "HTTP session refresh"; tunneling (open/send/recv/close via Proxy.NO_PROXY, bypassing egress monitoring), command execution, and purge (zeroes request*.log, deletes itself).

Attacker usernames: Nxploited_[a-zA-Z0-9]{3}, labadmin_<hex>, 0xTerror, svc_[a-zA-Z0-9]{8}, plus decoys like jfrog-distribution, jfrog-insight, repo-service.

What to do

Upgrade to a fixed version for your branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20 or later. If exposed while vulnerable, assume compromise and hunt artifacts; reset Access signing keys where plugins are found. Prioritize internet-facing instances and restrict network access.

Detections (behavioral):

  • CVE-2026-42018: a 401 on bare /access/api/v1/aws/token/ followed by a 200 on a variant from the same client in a short window.
  • CVE-2026-42016: the anonymous/low-priv identity minting tokens at POST /access/api/v1/tokens, enumerating users, or touching /artifactory/api/plugins.
  • CVE-2026-82329: POST /access/api/v1/registry/join returning 200/201, correlated with admin-user creation, GET /api/system/configuration, or token/user enumeration.

Caveats

The registry/join 200/201 alone is not proof of exploitation — correlate with post-exploitation actions. Log-based detections are undermined by purge/metrics.groovy anti-forensics. Exploitation windows observed: Aug 15–Sep 8 (chained 42018/42016) and Sep 1–8 (82329).

CVEs named here

Technologies named here

Techniques named here

  • Authentication bypass via trailing-slash request
  • Token scope escalation
  • Authentication bypass via registry join endpoint
  • Persistent admin account creation
  • Malicious Groovy plugin deployment
  • Ad-hoc command execution via plugin endpoint
  • Second-stage payload delivery
  • Webshell upload
  • Configuration exfiltration
  • Database credential/token dump
  • Access signing key theft
  • Obfuscated command execution
  • Detection evasion via error-based output
  • In-memory servlet filter implant
  • Split loader/implant persistence
  • Network tunneling / proxy bypass
  • Anti-forensics log/plugin purge
  • Cluster join key theft
  • Bring-your-own-key persistence
  • Enumeration

Threat actors named here

  • Unnamed multiple actors
  • Custom Rust backdoor

Related in AppSec