Artifactory’s blank default join key lets an anonymous network caller mint a platform-administrator token.
The Access service accepts attacker-authored HS256 join claims and returns a non-expiring administrator token.
JFrog Artifactory, a self-hosted artifact repository and CI/CD package control plane.
Unauthenticated platform-administrator takeover
We move this above the higher-ranked HPE scope expansion because a shipped default turns anonymous network reachability into administrator access, with runnable code confirming the complete path.
Detail and 2 sources
An attacker signs chosen join claims with the public blank key, submits them to the registry join endpoint, and receives administrator scope without authenticating.
That token can reset the built-in administrator password, mint more tokens, and modify repositories or artifacts.
The request sequence has been reproduced, and JFrog has published a fixed-version matrix.
- access:network:internet
- reachable from the public internet
- interaction:none
- no user action required