AIKIDO-2026-853477

TL;DR

JFrog Artifactory has an authentication weakness that, under the default configuration, can let an unauthenticated attacker with network access obtain administrative privileges. A successful exploit yields full administrative control of the Artifactory instance, and therefore of the artifacts, container images, and packages it serves to downstream builds. This issue is reported to be exploited in the wild within days of disclosure, with attackers minting themselves administrative tokens. JFrog has released patched builds on the supported 7.111, 7.117, 7.125, 7.133, 7.146, and 7.161 branches; after upgrading, review administrator accounts and issued access tokens, revoke anything unrecognized, and treat artifacts published while exposed as suspect.