GoKawiilA critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide administrative access.
The flaw is present in the default configuration of self-managed instances of JFrog Artifactory, a repository manager used to store, organize, secure, and distribute software packages.
An unauthenticated attacker with network access could exploit it to gain administrative permissions.
Researchers at offensive security company watchTowr observed the flaw being exploited by "attackers minting themselves admin tokens."
Details about the flaw are scarce, and JFrog’s advisory does not share many details beyond that the flaw is exploitable in Artifactory’s default configuration.
Vercel CEO Guillermo Rauch warned that the flaw’s impact could extend beyond compromising Artifactory itself.
"Administrative access to Artifactory reaches released artifacts that downstream systems already trust and pull automatically," Collin Hogue-Spears, Senior Director of Solution Management at application security company Black Duck, told BleepingComputer.
Spears also notes that JFrog treats access tokens as independent credentials with their own expiration and revocation mechanisms, so upgrading the Artifactory binary does not by itself invalidate an already-issued token.
Because organizations use Artifactory to store binaries and packages consumed by build and deployment systems, attackers with administrative access could replace trusted artifacts and potentially execute malicious code on downstream systems.
Rauch also speculated that the vulnerability might be connected to recent research involving autonomous AI agents.
... continue reading