ET WEB_SPECIFIC_APPS JFrog Self-Managed Artifactory Authentication Bypass (CVE-2026-82329)

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (
    msg:"ET WEB_SPECIFIC_APPS JFrog Self-Managed Artifactory Authentication Bypass (CVE-2026-82329)";
    flow:established,to_server;
    http.uri;
    content:"/access/api/v1/registry/join"; fast_pattern;
    http.content_type;
    content:"text/plain";
    http.request_body;
    content:"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9|2e|";
    pcre:"/^[^\x2e]*?(?:UzYjBjNDQyOThmYzFjMTQ5YWZiZjRjODk5NmZiOTI0MjdhZTQxZTQ2NDliOTM0Y2E0OTU5OTFiNzg1MmI4NT|ZTNiMGM0NDI5OGZjMWMxNDlhZmJmNGM4OTk2ZmI5MjQyN2FlNDFlNDY0OWI5MzRjYTQ5NTk5MWI3ODUyYjg1N|lM2IwYzQ0Mjk4ZmMxYzE0OWFmYmY0Yzg5OTZmYjkyNDI3YWU0MWU0NjQ5YjkzNGNhNDk1OTkxYjc4NTJiODU1)/R";
    http.method;
    content:"POST";
    reference:url,bishopfox.com/blog/cve-2026-82329-unauthenticated-administrative-access-in-jfrog-artifactory-via-an-empty-cluster-join-key;
    reference:cve,2026-82329;
    classtype:web-application-attack;
    sid:2072399; rev:1;
    metadata:affected_product JFrog, attack_target Server, tls_state TLSDecrypt, created_at 2026_10_08, cve CVE_2026_82329, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2026_10_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
    target:dest_ip;
)