Hackers exploit critical JFrog Artifactory flaw to forge admin tokens

A critical authentication bypass flaw (CVE-2026-82329) in JFrog Artifactory's default configuration allowed unauthenticated attackers to forge administrative tokens without any credentials, exposing self-managed instances to full compromise. Because Artifactory serves as a central repository for software artifacts and build dependencies, administrative access hands attackers the ability to inject malicious code into trusted packages, poisoning downstream software supply chains. The fact that this flaw exists in default configurations means organizations that never hardened their deployment were silently vulnerable from the moment of installation. This incident underscores that artifact repository platforms are high-value targets requiring the same rigorous patch and configuration discipline as perimeter-facing systems.