A critical JFrog Artifactory authentication-bypass flaw is being exploited in attacks that create administrative access tokens, according to BleepingComputer. The vulnerability, tracked as CVE-2026-82329, affects the default configuration of self-managed Artifactory instances, the report says. Artifactory is widely used to store, organize, secure and distribute software packages. BleepingComputer reports that an unauthenticated attacker with network access could exploit the flaw to gain administrative permissions, a position that can matter well beyond the repository manager itself because build and deployment systems may already trust the artifacts it serves. The exploitation claim comes with important limits. BleepingComputer cites researchers at offensive security firm watchTowr as having observed attackers “minting themselves admin tokens,” but also says technical details remain scarce and that JFrog’s advisory does not provide much beyond the default-configuration exposure. BleepingComputer said it contacted JFrog to confirm the reported activity and had not received a response at publication time. The reported token behavior is the core risk. Collin Hogue-Spears, senior director of solution management at Black Duck, told BleepingComputer that administrative access to Artifactory reaches released artifacts that downstream systems already trust and pull automatically. He also noted that JFrog treats access tokens as separate credentials with their own expiration and revocation mechanisms, meaning an upgrade to the Artifactory binary would not, by itself, invalidate a token that had already been issued. BleepingComputer reports that attackers with forged administrative tokens could perform sensitive actions including enumerating users, groups and federated topologies; reading artifacts; changing security configurations; and poisoning existing packages. The downstream concern is that organizations often connect Artifactory to automated build and deployment workflows, so a compromised repository can become a route into systems that consume trusted binaries and packages. JFrog addressed the issue on August 28 in Artifactory versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20, according to BleepingComputer. The vendor also says JFrog Cloud environments were already protected. What remains unresolved is the scale. BleepingComputer says victim counts, telemetry details and indicators of compromise are unclear, and it is not yet clear from the provided reporting whether servers were actually breached. Vercel CEO Guillermo Rauch also speculated that the vulnerability might be connected to recent research involving autonomous AI agents, but the report does not establish that connection as fact. Who benefits: Attackers benefit from administrative access to a repository layer that downstream systems may already trust. Defenders benefit from JFrog’s patched Artifactory versions and from treating token review as part of remediation. Who's exposed: Self-managed Artifactory users running affected versions in the default configuration are the exposed group identified in the report. JFrog Cloud environments were already protected, according to the vendor statement cited by BleepingComputer.