Poisoned Pipeline / Incidents / AS190

AS190 · 2026-09

In-the-wild JFrog Artifactory auth bypass (CVE-2026-42016/42018/82329)

CI/CD SaaS

Wiz Research (10 Sep 2026): active exploitation of three Artifactory
vulnerabilities chained to bypass authentication and gain admin control.
Artifact-registry compromise is a supply-chain origin (T0209 class). OpenInfra Europe notice: their Nordix Artifactory was compromised on 31 Aug 2026 through CVE-2026-82329. Downloads from artifactory.nordix.org between 28 Aug and 15 Sep 2026 should be treated as potentially tampered. Discovered 15 Sep.

Mapped techniques

• T0209 Compromise package registry or CDN origin
• T0137 Weak authentication methods
• T0104 Discover coding flaws

supply-chain registry takeover

Sources

• https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
• https://openinfraeurope.org/