decrypted · 4 september 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

The JFrog Artifactory bug that hands out its own spare key

JFrog Artifactory, the software repository that sits behind countless UK build pipelines, spent the first weekend of September being quietly taken over by attackers who needed no password. A critical authentication bypass, CVE-2026-82329, let anyone with network access mint themselves administrator credentials on self-hosted Artifactory instances that were never given an extra safeguard, which describes most of them. JFrog shipped a fix on 28 August. Attackers were exploiting the flaw within days. What makes this worth five minutes of your morning is not the speed of the attack but the fact that the vulnerability was not really a bug: it was a design decision that quietly came back to bite.

The master key nobody asked for

Artifactory's authentication runs through a component called JFrog Access, which issues and checks the credentials that let servers and users talk to each other. To join a cluster, a node normally needs a "join key", a shared secret set by the administrator. Researchers at watchTowr found that instances which never had that extra key explicitly configured were quietly issued a default one anyway: a "phantom" join key generated behind the scenes. Anyone who worked out the pattern could forge it, present it as proof of trust, and walk out with an admin token. It is the digital equivalent of a locksmith fitting every door with a spare key cut to the same pattern, then hoping nobody notices the pattern repeats.

A single admin account, wired into everything

Artifactory does not sit at the edge of a network, it sits in the middle of the software supply chain, holding the binaries, containers and packages that become production systems. JFrog's Yoav Landman stressed this was "improper authentication rather than remote code execution" and that the firm's own cloud-hosted customers were patched automatically, only self-hosted deployments were exposed. That distinction will matter to auditors, but it is cold comfort to any UK organisation running Artifactory on its own infrastructure, precisely the setup regulated and security-conscious firms tend to prefer. An attacker holding admin rights there can read every credential the platform brokers, enumerate connected identity providers, and quietly interfere with what comes out the other end. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 2 September, alongside six others already being used to drop reverse shells and cryptominers.

The lesson is not simply "patch faster", though upgrading to the fixed release matters. It is that a security control which degrades silently to something insecure by default is worse than no control at all, because it looks like protection right up until someone finds the gap. Anyone running self-hosted Artifactory should confirm an explicit join key is set rather than assume a default install was safe, rotate tokens, and check logs for admin accounts nobody remembers creating.

Also this week

The same CISA batch included CVE-2026-59822, an authentication bypass in BerriAI's LiteLLM, the gateway many teams now use to route requests between applications and large language models. Its handler for the Model Context Protocol was meant to fall back on an upstream provider's login if its own key check failed; instead it fell back to an empty authentication object, letting anyone with a made-up bearer token list and call whatever tools the gateway was wired up to. Wiz found it being probed against honeypots within days of disclosure. As UK organisations bolt AI agents onto real systems, the access-control layer in front of the model deserves at least as much scrutiny as the model itself, since it is where the blast radius actually lives.

In the House of Lords, the Cyber Security and Resilience Bill picked up a striking amendment this week. Peer Tim Clement-Jones, backed by a cross-party group including Dido Harding and Beeban Kidron, wants to give ministers a "last resort" power to order data centres offline or deactivate an AI system judged to threaten national security or critical infrastructure. Clement-Jones has called it a "vital safety net" that would let the government "halt a runaway system" before it can compromise critical national infrastructure. Whatever you make of the politics, it is a tacit admission that voluntary safeguards are not seen as sufficient once AI is embedded in critical UK systems, and a sign that boards deploying agentic AI should expect regulatory interest in shutdown and containment, not just in model accuracy.

Manchester Airports Group's breach also moved on this week. The FulcrumSec group has now published the stolen data, and it is considerably larger and more detailed than first disclosed: roughly 640GB once extracted, including booking references, spending history, device data and around 200,000 records tied to travel still to come this year. The group says access came via airport-specific API credentials exposed in client-side JavaScript, a detail MAG has so far declined to confirm or deny. It is a reminder that early breach disclosures are usually a floor, not a ceiling, on the eventual damage.

Sources

If you want a second pair of eyes on your own supply chain or AI deployment risk, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.

Play here Loads Apple's player when you press it.