Threat intelligence researchers at Wiz disclosed active in-the-wild exploitation chaining two vulnerabilities in self-hosted JFrog Artifactory servers. The attack primitive begins with CVE-2026-42018, which leaks an internal anonymous token to unauthenticated HTTP callers even with anonymous access disabled. Threat actors then leverage CVE-2026-42016 at the token-creation API to exchange this low-privilege credential for full administrator scope; because Artifactory validates token cryptographic signatures and issuers but neglects scope enforcement, unauthenticated callers obtain root-equivalent bearer tokens within minutes, logging actions under token:anonymous.

Observed intrusions established persistence by provisioning rogue administrator accounts, executing arbitrary code via malicious Groovy plugins, and dropping a custom Rust command-and-control backdoor from /tmp. Attackers have also exploited standalone authentication bypass CVE-2026-82329 (CVSS 9.8) to exfiltrate cluster join keys. While JFrog released backported patches across supported release branches (including 7.133.11 and 7.161.20), upgrading binaries does not invalidate existing forged tokens or evict implanted accounts, leaving unmitigated environments exposed to persistent supply-chain compromise.

Why it matters:

• Unauthenticated scope escalation and silent persistence: Bypassing authentication to mint admin-scoped tokens without modifying user registries defeats role-based access controls and perimeter filtering, enabling adversaries to deploy arbitrary Groovy plugins and backdoors that run with the server’s full daemon privileges.
• Immediate token invalidation and cluster key rotation: Applying JFrog’s updates closes the exploit chain but fails to neutralize existing compromises; defenders must immediately audit for rogue administrative accounts, invalidate all pre-patch bearer tokens, and regenerate cluster join keys in system.yaml.