OpenInfra Europe's JFrog Artifactory breached, packages potentially compromised

September 30, 2026 at 03:39 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Attackers compromised a self-hosted JFrog Artifactory instance operated by OpenInfra Europe, the regional hub of the OpenInfra Foundation. The foundation warned that anyone who downloaded artifacts from artifactory.nordix.org between August 28 and September 15, 2026 should stop using them and treat them as potentially compromised. The breach was discovered on September 15 after a legitimate user was denied access.

Key Facts

OpenInfra Europe's JFrog Artifactory instance was compromised on August 31, 2026, and the breach was discovered on September 15.
The compromised instance was running a vulnerable JFrog Artifactory version that allowed exploitation of CVE-2026-82329, an authentication bypass vulnerability.
CVE-2026-82329 was publicly disclosed on August 28, 2026, and added to CISA's Known Exploited Vulnerabilities catalog on September 2.
OpenInfra Europe advises anyone who downloaded artifacts from artifactory.nordix.org between August 28 and September 15, 2026 to stop using them and remove them from pipelines.
The affected system was immediately isolated and an investigation began, but the full scope and impact of the incident is still undetermined.

Compromise Details

The compromised instance was running a vulnerable JFrog Artifactory version that allowed unauthenticated attackers to exploit CVE-2026-82329, an authentication bypass vulnerability. Exploitation of the vulnerability granted attackers admin privileges, enabling them to tamper with the deployment, artifacts, credentials, and integrations managed by the instance. OpenInfra Europe states that the compromise occurred on August 31, 2026, the same day in-the-wild exploitation of CVE-2026-82329 began according to various sources. The breach was discovered on September 15, 2026, after a legitimate user was denied access to the system.

Vulnerability Timeline

CVE-2026-82329 was publicly disclosed on August 28, 2026. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on September 2, 2026. In-the-wild exploitation of the vulnerability began on August 31, 2026, according to various sources.

Response and Impact

OpenInfra Europe immediately isolated the affected system and began an investigation. The foundation advises anyone who downloaded or installed artifacts from artifactory.nordix.org between August 28 and September 15, 2026 to stop using them, remove them from pipelines, and treat them as potentially compromised. The full scope and impact of the incident is still undetermined.