Workflow
Artifactory Auth Bypass (CVE-2026-82329)
Self-managed Artifactory hosts in. One anonymous version compare vs the CVE-2026-82329 CNA floors. Does not mint tokens.
Workflow
100%
loading
Loading content
loading
Self-managed Artifactory hosts in. One anonymous version compare vs the CVE-2026-82329 CNA floors. Does not mint tokens.
This workflow finds self-managed JFrog Artifactory consoles and sorts each one by whether its version predates the CVE-2026-82329 CNA floors. CVE-2026-82329 is an authentication bypass (CWE-287, CVSS 9.8) that, on a default-configured self-managed install, lets an unauthenticated attacker obtain administrative privileges. watchTowr Intel is already seeing that used to mint admin tokens. Give it hostnames, IP addresses, CIDR ranges (up to 1024 addresses), host:port, or full URLs including a path prefix. The workflow TCP-probes 443, 80, 8082, 8081, 8443, and any port you named, then identifies the 7.x Platform shell and reads a product version from the official JSON or Artifactory headers. httpx fingerprints on the side; it is not the sorter. A below-floor version is patch-lag. The run does not log in, does not mint a token, and does not send a bypass payload. You can feed the per-host verdict into exposure management.
JFrog cloud (*.jfrog.io) is already fortified. The check marks those hostnames cloud_already_patched and leaves them. A remote version read cannot see whether the host still has the default config, so a vulnerable row is not a proven token mint.
Production consoles usually sit on HTTPS 443. 8082 is the 7.x router and UI. 8081 is the Artifactory API. The check identifies the product from title Login - JFrog (or {View} - JFrog), jfrog-ui-essentials, /ui/jfrog.svg, X-Artifactory-*, X-JFrog-Version, or Server: Artifactory/. A path of /ui/login alone is not enough. Version comes first from a 200 JSON at /artifactory/api/system/version (version field). A 401 on that path is headers only; the error body is not scored. It then tries GET /ui/api/v1/system/version only when that body is Artifactory-shaped JSON (version and revision). A header-only version that meets a CNA floor stays under_investigation, because product and service versions can differ by a patch. Product with no version is version_hidden. On a modern 7.x with anonymous off and a proxy that strips Artifactory headers, version_hidden is the expected row: the shell was found, the build was not. JS manifest.js?v=7.x cache-busters are ignored. The check never requests a token endpoint. HTTP on 8081/8082 is retried once over HTTPS if nothing answers. Closed TCP ports are not walked over HTTP.
The CNA lists affected ranges from 0 before 7.111.21, then 7.117.0 before 7.117.28, 7.125.0 before 7.125.20, 7.133.0 before 7.133.29, 7.146.0 before 7.146.38, and 7.161.0 before 7.161.20. A version on a listed train at or above that train's floor is patched. A version below its floor, or below 7.111.21 on an older train, is vulnerable. A minor the CNA did not name (for example 7.150) is under_investigation; the check will not invent a patched verdict. This ID is not on CISA KEV.
.jfrog.io are marked cloud and left.https://corp.example.com:9443/jfrog stays on 9443 under /jfrog). Point it at self-managed Artifactory you are authorised to test. The probe hits 443 first, then 80, 8082, and 8081.version_source (json or header), train, cloud, title, verdict, and action (upgrade_to_cna_floor, read_version_on_host, confirm_train_on_host, confirm_product_version_on_host, leave).product, affected, cloud, version_hidden, under_investigation) plus the six CNA floors.The records below are illustrative and do not come from a real run. They show a host below its train floor, a host whose version was hidden, and a JFrog cloud hostname.
| url | host | port | cve | product_version | version_source | train | cloud | verdict | action | vulnerable | title | detail |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| https://repo-a.example.com:443 | repo-a.example.com | 443 | CVE-2026-82329 | 7.161.19 | json | 7.161 | false | vulnerable | upgrade_to_cna_floor | true | Login - JFrog | JFrog Artifactory 7.161.19 is below the CNA floor 7.161.20 |
| http://repo-b.example.org:8082 | repo-b.example.org | 8082 | CVE-2026-82329 | null | null | null | false | version_hidden | read_version_on_host | false | Login - JFrog | JFrog Artifactory detected but no product version was in the anonymous JSON or Artifactory headers; read it on the host |
| https://acme.jfrog.io:443 | acme.jfrog.io | 443 | CVE-2026-82329 | null | null | cloud | true | cloud_already_patched | leave | false | null | JFrog Artifactory on *.jfrog.io is JFrog cloud; CVE-2026-82329 is self-managed only |
{"cve": "CVE-2026-82329", "hosts_checked": 3, "product": 3, "affected": 1, "cloud": 1, "patched": 0, "version_hidden": 1, "under_investigation": 0}No. The run is one anonymous version compare against the CNA floors. A vulnerable row is patch-lag on that floor. It does not send the bypass and it does not mint a token. watchTowr Intel is seeing that activity in the wild; this check does not reproduce it.
No. JFrog says *.jfrog.io is already fortified. The workflow short-circuits those hostnames (*.pe.jfrog.io included) as cloud_already_patched. *.jfrog.com is not Cloud Artifactory and still gets the version check.
version_hidden means the host looked like Artifactory (title Login - JFrog, jfrog-ui-essentials, or Artifactory headers) but no product version was in a 200 JSON or X-JFrog-Version / Server banner. That is the usual modern 7.x result when anonymous access is off and the proxy ate the headers. under_investigation means a version was read on a train the CNA did not list, or a header-only version that meets a floor. Read the product version on the host. The workflow will not invent a patched row.
Anything below 7.111.21, plus the listed trains below 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20. A minor between those trains is under_investigation. This ID is not on CISA KEV.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.