CVE-2026-82329 Elastic Security · Elastic

Detect JFrog Artifactory Improper Authentication Admin Token Forgery (CVE-2026-82329) in Elastic Security

Detects exploitation of CVE-2026-82329, a critical improper authentication (CWE-287) vulnerability in JFrog Artifactory that allows unauthenticated attackers to forge administrative access tokens and bypass authentication. Actively exploited in the wild (CISA KEV). This detection surfaces suspicious access-token creation, unauthenticated administrative API calls, and anomalous privileged actions against Artifactory endpoints (e.g. /access/api/v1/tokens, /artifactory/api/security). Attackers leveraging this flaw can forge admin JWT/access tokens to pull, push, poison, or exfiltrate artifacts from repositories, enabling downstream supply-chain compromise.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Credential Access

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by source.ip with maxspan=5m
  [ network where url.path : ("/access/api/v1/tokens", "/access/api/v1/token", "/artifactory/api/security/token") and http.request.method in ("POST","PUT") and (user.name == null or user.name == "anonymous") and http.response.status_code in (200,201) ]
  [ network where url.path : ("/artifactory/api/security/users*", "/access/api/v1/users*", "/artifactory/api/system/configuration") and http.request.method in ("POST","PUT","DELETE") ]
critical severity medium confidence

Correlates an anonymous successful token-creation request followed by an administrative action from the same source IP, matching the CVE-2026-82329 forge-then-abuse pattern.

Data Sources

Network Proxy LogsArtifactory Access Logs

Required Tables

logs-network.*logs-web.*

False Positives & Tuning

  • Automated pipelines that create a token then immediately manage users under a service identity not captured in user.name.
  • Vulnerability scanners chaining token and admin endpoint requests.
  • Proxy normalization that nulls the user field for authenticated backend calls.

Other platforms for CVE-2026-82329

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Anonymous access token creation request against Artifactory

    Expected signal: Web/proxy access log entry: POST /access/api/v1/tokens with anonymous or empty user and a 200/201 response.

  2. Test 2Anonymous admin user enumeration via Artifactory security API

    Expected signal: Web/proxy access log entry: POST /artifactory/api/security/users/atk_test with a 200/201 response and anonymous principal.

  3. Test 3Windows PowerShell anonymous token forgery probe

    Expected signal: IIS/reverse-proxy log entry: POST /access/api/v1/tokens with anonymous user and success status from a Windows source.

Last updated: 2026-09-03 Research depth: standard
References (7)

Response Playbook

Triage

  1. Confirm the Artifactory version against JFrog security advisories; determine whether the instance is running an unpatched release vulnerable to CVE-2026-82329.
  2. Review the flagged source IP and user agent — determine whether the token-creation request originated from an expected CI/CD system, a known scanner, or an unrecognized external host.
  3. Pull the Artifactory access.log and request.log for the time window and identify any access tokens created without a valid preceding authentication event.
  4. Enumerate all access tokens (admin and non-admin) created in the exposure window via the Access service and correlate their subjects/scopes against expected owners.

Containment

  1. Revoke all suspicious or unexplained access tokens immediately via the Access API (/access/api/v1/tokens) and rotate the Artifactory master/join keys.
  2. Block the offending source IP(s) at the perimeter/WAF and restrict administrative API endpoints to trusted management networks.
  3. Upgrade Artifactory to the fixed release per JFrog advisory and disable anonymous access until patched.

Evidence Collection

  1. Preserve Artifactory access.log, request.log, and the reverse-proxy/IIS/nginx access logs covering the full exposure window.
  2. Export the current list of access tokens with their creation timestamps, subjects, scopes, and expiry for forensic comparison.
  3. Capture repository audit events (artifact pushes, deletes, permission changes) attributable to forged tokens for supply-chain impact assessment.

Escalation Criteria

  • !Escalate to incident response if any admin-scoped token was created by an anonymous or unauthenticated request, or if forged tokens were used to modify permissions or repositories.
  • !Escalate to supply-chain/security leadership if artifacts were pushed, overwritten, or exfiltrated using a forged token, as downstream consumers may be affected.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Artifactory access.log entries showing token creation without a preceding authentication event.
  • >Access service token store containing tokens with anomalous subjects, scopes, or issuance times.
  • >Reverse-proxy/IIS access logs showing anonymous POSTs to /access/api/v1/tokens returning 200/201.
  • >Repository event audit trail showing artifact pushes or permission changes tied to suspect tokens.

Tuning Guidance

Baseline the source IPs and user agents of legitimate CI/CD systems and service accounts that create Artifactory access tokens, and allowlist them. If your reverse proxy authenticates before forwarding, ensure the authenticated username is preserved in logs so the anonymous-user filter is meaningful; where it is not, pivot the detection onto the Artifactory access.log itself, which records the authenticated subject. Tighten severity for admin-scoped token creation and lower it for short-lived non-admin tokens.

Hunting Queries

Surfaces hosts generating access tokens against Artifactory, ranked by volume, to spot bulk or anonymous token creation.

Hunting — KQL
kql 
W3CIISLog | where csUriStem has "/access/api/v1/tokens" and csMethod == "POST" and scStatus in (200,201) | summarize count() by cIP, csUserName, bin(TimeGenerated, 1h) | order by count_ desc
Hunting — SPL
spl 
index=web uri_path="/access/api/v1/tokens" method=POST status IN (200,201) | stats count values(user) AS users by src_ip | sort - count

Atomic Red Team Tests

Test 1 Anonymous access token creation request against Artifactory
linux

Simulates an unauthenticated POST to the Artifactory access-token endpoint to generate detection telemetry (lab only).

Command

bash 
curl -s -k -X POST 'https://artifactory.lab.local/access/api/v1/tokens' -H 'Content-Type: application/x-www-form-urlencoded' -d 'scope=applied-permissions/admin&expires_in=0'

Cleanup

bash 
curl -s -k -X DELETE 'https://artifactory.lab.local/access/api/v1/tokens/revoke' -d 'token=$TEST_TOKEN' 2>/dev/null; true

Expected Telemetry

Web/proxy access log entry: POST /access/api/v1/tokens with anonymous or empty user and a 200/201 response.

Expected Detection

KQL/SPL rule fires on anonymous successful POST to /access/api/v1/tokens.

Test 2 Anonymous admin user enumeration via Artifactory security API
linux

Simulates a forged-token holder listing/creating users through the admin security API (lab only).

Command

bash 
curl -s -k -X POST 'https://artifactory.lab.local/artifactory/api/security/users/atk_test' -H 'Content-Type: application/json' -d '{"email":"[email protected]","password":"P@ssw0rd123","admin":true}'

Cleanup

bash 
curl -s -k -X DELETE 'https://artifactory.lab.local/artifactory/api/security/users/atk_test' 2>/dev/null; true

Expected Telemetry

Web/proxy access log entry: POST /artifactory/api/security/users/atk_test with a 200/201 response and anonymous principal.

Expected Detection

Detection flags anonymous write to the admin security users endpoint.

Test 3 Windows PowerShell anonymous token forgery probe
windows

Simulates the token-forgery request from a Windows host to validate cross-platform telemetry (lab only).

Command

powershell 
powershell -Command "Invoke-WebRequest -UseBasicParsing -Method POST -Uri 'https://artifactory.lab.local/access/api/v1/tokens' -Body 'scope=applied-permissions/admin&expires_in=0' -ContentType 'application/x-www-form-urlencoded'"

Cleanup

powershell 
powershell -Command "Remove-Variable TEST_TOKEN -ErrorAction SilentlyContinue"

Expected Telemetry

IIS/reverse-proxy log entry: POST /access/api/v1/tokens with anonymous user and success status from a Windows source.

Expected Detection

W3CIISLog-based KQL rule fires on anonymous successful token creation.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0006Credential Access

Related Techniques

T1190Exploit Public-Facing ApplicationT1552.004Private KeysT1078.004Cloud Accounts

Same Tactic: Initial Access

Popular Detections