# Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

Unauthenticated attackers chained Artifactory token-scope and auth-bypass flaws to mint admin tokens, then deployed Groovy plugins and Rust backdoors for persistence.

- Payout: Real-world hack
- Severity: critical
- Program: JFrog Artifactory
- Credited: Wiz Research
- Disclosed: 2026-09-10
- CVE: CVE-2026-42016, CVE-2026-42018, CVE-2026-82329
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
- Tags: domain:infra domain:web impact:data-leak impact:privesc impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:chained technique:legacy-endpoint vuln:auth-bypass vuln:privilege-escalation vuln:rce

**Target:** Self-hosted JFrog Artifactory (Access API, plugin framework)
**Root cause:** CVE-2026-42018 returns an internal anonymous-user JWT to unauthenticated requesters via a trailing-slash variant of /access/api/v1/aws/token/; CVE-2026-42016 validates token signature/issuer but not scope, letting that low-priv token be exchanged for admin scope; CVE-2026-82329 allows unauthenticated POST /access/api/v1/registry/join to return an admin-scoped token under default config.
**Steps:**
1. `POST /access/api/v1/aws/token/` (trailing slash) -> 200 with anonymous JWT (CVE-2026-42018)
2. `POST /access/api/v1/tokens` with that JWT -> 200 admin-scoped token, username still anonymous (CVE-2026-42016)
3. `PUT /api/security/users/<username>` or `/access/api/ui/users/<username>` with `customData.artifactory_admin: true` -> 201 persistent admin account
4. Alternatively `POST /access/api/v1/registry/join` -> 200/201 admin token (CVE-2026-82329)
5. Drop Groovy plugin into `$JFROG_HOME/var/etc/artifactory/plugins/` and call `GET/POST /artifactory/api/plugins/execute/<name>` for RCE
6. Fetch second-stage binary to `/dev/shm`, `/tmp`, or `/var/tmp` and establish C2
**How found:** Wiz observed in-the-wild traffic: a 401 on the bare /access/api/v1/aws/token path followed by 200 on the trailing-slash variant, then anonymous identity minting tokens and enumerating users/plugins — behavioral anomalies indicating operator probing and escalation.
**Exploitation:** Unauthenticated HTTP requests mint an admin-scoped token (two-step via 42018+42016, or one-step via 82329). With admin, actors created persistent admin users, exfiltrated config via GET /api/system/configuration, enumerated users/repos/tokens, stole the Access join key and private.key, attached their own SSH keys, deployed malicious Groovy plugins for unsandboxed RCE in the Artifactory JVM, and dropped Rust backdoors with C2.
**Escalation:** Chained low-priv anonymous token (42018) with scope-validation flaw (42016) to reach admin; then plugin framework for RCE, in-memory Tomcat servlet filter implant (metrics.groovy) that survives patching, and Access private.key theft enabling indefinite token forgery for any user/scope.
**Insight:** Trailing-slash and path-variant differentials on auth endpoints can bypass routing/auth middleware; and low-priv token exchange endpoints that validate signature but not scope turn a minor token leak into full admin — always test token-minting endpoints with the weakest token you can obtain.