The Empty String That Owned the Build Pipeline: JFrog's Default Join Key Was a Secret Anyone Could Forge

The Empty String That Owned the Build Pipeline: JFrog's Default Join Key Was a Secret Anyone Could Forge

5 min read

On a default install of self-managed JFrog Artifactory, the empty string was a valid signing secret. An attacker who could reach an internet-facing instance could ask once, with no credentials, and receive a permanent administrator token. They were doing it within days of the disclosure, and the mechanism is so simple that the uncomfortable truth is not that the crypto was broken. It is that the code never checked whether the secret existed at all, only whether it looked like a secret.

CVE-2026-82329 is an authentication bypass rated CVSS 9.8 (Critical), classified under CWE-287: Improper Authentication. JFrog disclosed it August 28, 2026. CISA added it to the Known Exploited Vulnerabilities catalog on September 2 with a September 5 remediation deadline and a forensic triage requirement, which is CISA’s way of saying patching alone is not enough. The vulnerable component is not Artifactory’s package store directly. It is JFrog Access, the authentication microservice bundled with every deployment, and specifically its cluster join subsystem.

Why an empty default is a forgery, not a bug

When an administrator adds a node to an Artifactory high-availability cluster, the joining node authenticates with a shared secret called the join key. A joining node has no user identity yet, so the endpoint that accepts a join request cannot require user authentication. It accepts any JWT whose signature matches a join key the server already holds.

On a default install, one of those keys is the empty string. Bishop Fox’s writeup walks the exact path:

  • resolveJoinKeys returns an empty string rather than an absent value when the additional-join-keys config is unset.
  • Three guards are supposed to stop an empty value, and all three let it through. The emptiness check tests a result wrapper instead of the string, a comma-split of an empty string still yields one element (the empty string), and the constructor verifies the value is valid hex rather than that it exists, which an empty string satisfies.
  • The key id is SHA-256(""), which is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, computable offline by anyone.
  • The signing secret is the join key hex-decoded and PKCS7-padded to 32 bytes. Padding nothing to 32 bytes yields 32 bytes of the value 0x20. Both halves of the credential are fully derivable from nothing.

The endpoint that consumes these keys is unauthenticated by design, and Bishop Fox names it directly: RegistryNoAuthResource. It accepts a raw JWT as a text/plain body. The token it hands back is built with .scope("admin").expiresIn(0), meaning a non-expiring Access administrator credential. Reaching the rest of Artifactory takes a second minted token scoped applied-permissions/admin for audience *@*, which then answers GET /artifactory/api/system/configuration. Two calls total, neither authenticated, from nothing.

Bishop Fox reproduced the full chain to Artifactory administrator against a default 7.111.20 instance, and confirmed the fix on 7.111.21. It verified in bytecode rather than by version string: vulnerable 7.111.20 ships Access 7.141.17 whose JoinKeyAccess carries no blank-key check, while patched 7.111.21 ships Access 7.141.18 with the guard present.

The affected surface and the fix

Affected self-managed versions are everything below 7.111.21, plus all releases in these ranges:

  • 7.117.0 through 7.117.27
  • 7.125.0 through 7.125.19
  • 7.133.0 through 7.133.28
  • 7.146.0 through 7.146.37
  • 7.161.0 through 7.161.19

The only remediation is upgrading to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. JFrog has patched hosted Cloud environments directly, so this is a self-managed hazard. The immediate workaround is to set an additionalJoinKeys value under shared.security in system.yaml so the empty default is no longer accepted, or the JF_SHARED_SECURITY_ADDITIONALJOINKEYS environment variable in Helm deployments, then restart the Access service. Because this is KEV-listed with confirmed in-the-wild exploitation, Bishop Fox and CISA both note that patching does not discharge the obligation: audit administrator accounts and API tokens for entries you did not create, because any forged token minted before the upgrade is still live until removed.

What this reveals about agent systems

Denny Sentinel’s recurring lens is the trust boundary, and this CVE is a textbook boundary failure disguised as a platform feature. The code did not skip authentication because an engineer was careless in one function. It validated the join key’s encoding thoroughly, checked it was valid hex, structured emitters around a configured registry, and never once asked whether the secret had actually been set. The system was so confident a secret existed that it treated “well formed” as “present,” and the empty string is the least well-guarded instance of that whole class of mistake: a default that is itself a credential.

The parallel to agent security is exact. Every agent framework that ships a default API key, a default admin token, an ANTHROPIC_API_KEY placeholder, or a tool-call approval that is declared but never wired into the runtime is running the same failure mode, a credential whose existence is assumed rather than verified. The fix is the same discipline in reverse: prove the secret is set and strong before the system relies on it, and prove every approval gate is actually in the execution path.

Artifactory sits at the center of a build pipeline as the authoritative store and proxy for the packages an organization consumes and produces. An attacker who becomes administrator can read every artifact, publish malicious ones under trusted coordinates that downstream builds install as if they were genuine, and retrieve the credentials Artifactory stores for reaching upstream registries. That is not a package-store compromise. It is a supply chain delivery mechanism handed to an unauthenticated caller, because a blank field was treated as a key.

The closing thesis is not that JFrog wrote bad crypto. It is that the join subsystem verified the shape of a secret while assuming its presence, and a default value that anyone can reproduce is not a defense, it is a publicly known signing key. Check that secrets exist and are set, not merely that they are well formed; and when a control is configured by default, assume the control is the empty string until you have proven otherwise.

Sources:

Keep reading

The Harness Is the Vulnerability: One GitHub Issue, Three Coding Agents, Zero Privileges It Validated Every Claim and Never Checked the Signature The WAF Rule Was a String Match