---
title: "CVE-2026-82329 Artifactory auth bypass check"
canonical: https://trickest.com/library/artifactory-auth-bypass-check-cve-2026-82329
description: "Find self-managed JFrog Artifactory below CVE-2026-82329 CNA floors. Version fingerprint, confirm path, no token mint. Cloud *.jfrog.io marked patched."
---

# CVE-2026-82329 Artifactory auth bypass check

## Overview

This workflow finds self-managed JFrog Artifactory consoles and sorts each one by whether its version predates the CVE-2026-82329 CNA floors. CVE-2026-82329 is an authentication bypass (CWE-287, CVSS 9.8) that, on a default-configured self-managed install, lets an unauthenticated attacker obtain administrative privileges. watchTowr Intel is already seeing that used to mint admin tokens. Give it hostnames, IP addresses, CIDR ranges (up to 1024 addresses), host:port, or full URLs including a path prefix. The workflow TCP-probes 443, 80, 8082, 8081, 8443, and any port you named, then identifies the 7.x Platform shell and reads a product version from the official JSON or Artifactory headers. [httpx](/tools/httpx) fingerprints on the side; it is not the sorter. A below-floor version is patch-lag. Hosts already flagged `vulnerable` then get one unauthenticated GET of `/artifactory/api/system/configuration`. A 200 with an admin-shaped body is `confirmed`. The run does not log in and does not mint a token. You can feed the per-host verdict into [exposure management](/use-cases/exposure-management).

JFrog cloud (`*.jfrog.io`) is already fortified. The check marks those hostnames `cloud_already_patched` and leaves them. Confirm skips cloud, patched, and version-hidden rows.

## How the check reads a version

Production consoles usually sit on HTTPS 443. 8082 is the 7.x router and UI. 8081 is the Artifactory API. The check identifies the product from title `Login - JFrog` (or `{View} - JFrog`), `jfrog-ui-essentials`, `/ui/jfrog.svg`, `X-Artifactory-*`, `X-JFrog-Version`, or `Server: Artifactory/`. A path of `/ui/login` alone is not enough. Version comes first from a 200 JSON at `/artifactory/api/system/version` (`version` field). A 401 on that path is headers only; the error body is not scored. It then tries `GET /ui/api/v1/system/version` only when that body is Artifactory-shaped JSON (`version` and `revision`). A header-only version that meets a CNA floor stays `under_investigation`, because product and service versions can differ by a patch. Product with no version is `version_hidden`. On a modern 7.x with anonymous off and a proxy that strips Artifactory headers, `version_hidden` is the expected row: the shell was found, the build was not. JS `manifest.js?v=7.x` cache-busters are ignored. The check never requests a token endpoint. HTTP on 8081/8082 is retried once over HTTPS if nothing answers. Closed TCP ports are not walked over HTTP.

The CNA lists affected ranges from 0 before 7.111.21, then 7.117.0 before 7.117.28, 7.125.0 before 7.125.20, 7.133.0 before 7.133.29, 7.146.0 before 7.146.38, and 7.161.0 before 7.161.20. A version on a listed train at or above that train's floor is `patched`. A version below its floor, or below 7.111.21 on an older train, is `vulnerable`. A minor the CNA did not name (for example 7.150) is `under_investigation`; the check will not invent a patched verdict. This ID is not on CISA KEV.

## Pipeline

1. Normalize the input scope. Keep an operator-supplied port and path. Expand a CIDR of 1024 addresses or fewer; skip larger ranges instead of probing the literal network string.
2. TCP-probe 443, 80, 8082, 8081, 8443, and any port you named. 8082 and 8081 are always considered. Only open listeners go on to the version check.
3. Turn each open listener into a URL, preserving a path prefix (HTTPS on 443 and 8443, HTTP on 80, HTTP on 8081 and 8082 with one HTTPS retry if the GET is silent).
4. Fingerprint each URL with [httpx](/tools/httpx) for title and status. That sidecar does not decide the verdict.
5. Request the official version JSON first, then the Platform UI, parse a three-part product version, and classify against the CNA trains. Hostnames ending in `.jfrog.io` are marked cloud and left.
6. Confirm only those flagged `vulnerable` with an unauthenticated GET of `/artifactory/api/system/configuration`. Skip cloud, patched, and version-hidden rows.
7. Emit one JSONL record per service and a summary line with verdict and confirmed counts.

## Inputs

- **Target scope.** Hostnames, IP addresses, or CIDR ranges, one per line. Full URLs and host:port entries keep their port and path (`https://corp.example.com:9443/jfrog` stays on 9443 under `/jfrog`). Point it at self-managed Artifactory you are authorised to test. The probe hits 443 first, then 80, 8082, and 8081.

## Outputs

- **results.jsonl.** One operator row per service: URL, version, `version_source` (`json` or `header`), train, `cloud`, title, verdict, `confirmed`, and `action` (`upgrade_to_cna_floor`, `read_version_on_host`, `confirm_train_on_host`, `confirm_product_version_on_host`, `leave`).
- **owner.csv.** The same rows for a ticket queue.
- **summary.json.** Manager counts (`product`, `affected`, `confirmed`, `cloud`, `version_hidden`, `under_investigation`) plus the six CNA floors.

## Sample output

The records below are illustrative and do not come from a real run. They show a host below its train floor, a host whose version was hidden, and a JFrog cloud hostname.

```jsonl
{"url": "https://repo-a.example.com:443", "host": "repo-a.example.com", "port": 443, "cve": "CVE-2026-82329", "product_version": "7.161.19", "version_source": "json", "train": "7.161", "cloud": false, "verdict": "vulnerable", "action": "upgrade_to_cna_floor", "vulnerable": true, "confirmed": true, "title": "Login - JFrog", "detail": "JFrog Artifactory 7.161.19 is below the CNA floor 7.161.20"}
{"url": "http://repo-b.example.org:8082", "host": "repo-b.example.org", "port": 8082, "cve": "CVE-2026-82329", "product_version": null, "version_source": null, "train": null, "cloud": false, "verdict": "version_hidden", "action": "read_version_on_host", "vulnerable": false, "title": "Login - JFrog", "detail": "JFrog Artifactory detected but no product version was in the anonymous JSON or Artifactory headers; read it on the host"}
{"url": "https://acme.jfrog.io:443", "host": "acme.jfrog.io", "port": 443, "cve": "CVE-2026-82329", "product_version": null, "train": "cloud", "cloud": true, "verdict": "cloud_already_patched", "action": "leave", "vulnerable": false, "title": null, "detail": "JFrog Artifactory on *.jfrog.io is JFrog cloud; CVE-2026-82329 is self-managed only"}
```

```json
{"cve": "CVE-2026-82329", "hosts_checked": 3, "product": 3, "affected": 1, "confirmed": 1, "cloud": 1, "patched": 0, "version_hidden": 1, "under_investigation": 0}
```

## FAQ

### Does a vulnerable verdict mean an attacker minted an admin token?

No. A `vulnerable` row is patch-lag on the CNA floor. Confirm only GETs `/artifactory/api/system/configuration` without credentials. It does not mint a token. watchTowr Intel is seeing token-mint activity in the wild; this check does not reproduce it.

### Does this apply to JFrog cloud?

No. JFrog says `*.jfrog.io` is already fortified. The workflow short-circuits those hostnames (`*.pe.jfrog.io` included) as `cloud_already_patched`. `*.jfrog.com` is not Cloud Artifactory and still gets the version check.

### What do version_hidden and under_investigation mean?

`version_hidden` means the host looked like Artifactory (title `Login - JFrog`, `jfrog-ui-essentials`, or Artifactory headers) but no product version was in a 200 JSON or `X-JFrog-Version` / `Server` banner. That is the usual modern 7.x result when anonymous access is off and the proxy ate the headers. `under_investigation` means a version was read on a train the CNA did not list, or a header-only version that meets a floor. Read the product version on the host. The workflow will not invent a patched row.

### Which Artifactory trains does this flag?

Anything below 7.111.21, plus the listed trains below 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20. A minor between those trains is `under_investigation`. This ID is not on CISA KEV.

## Related workflows

- [PaperCut NG/MF RCE (CVE-2026-81578)](/library/papercut-ng-rce-check-cve-2026-81578). Same port-then-version pattern for a print-server chain, instead of this Artifactory CNA compare.
- [cPanel & WHM File Write (CVE-2026-65643)](/library/cpanel-rce-check-cve-2026-65643). Same build-compare shape for a hosting control panel, instead of JFrog trains.
- [Full Network Port and Service Assessment](/library/full-network-port-and-service-assessment). Map 8081/8082 (and whatever sits in front of them) across a fleet first, instead of assuming every artifact host still uses the default ports.

---
_Markdown source of https://trickest.com/library/artifactory-auth-bypass-check-cve-2026-82329._