OpenInfra Foundation Warns of Compromised Software Repository Following Exploitation of Unpatched Authentication Bypass Flaw

Attackers compromised an OpenInfra Europe-hosted JFrog Artifactory instance by exploiting an authentication bypass vulnerability between August 28 and September 15, 2026, potentially compromising software packages stored in the repository. The breach leveraged CVE-2026-82329, a critical flaw publicly disclosed in late August that allows unauthenticated attackers to gain administrative access and tamper with deployments, artifacts, credentials, and integrations. The organization discovered the incident after nearly three weeks when a legitimate user was denied access, and investigators are still determining the full scope and impact of the breach.

The OpenInfra Foundation, a division of the Linux Foundation, maintains infrastructure for open source cloud and datacenter projects, with OpenStack being its most prominent offering. The organization discovered the intrusion after nearly three weeks when standard access controls unexpectedly denied a legitimate user entry to the system. This delayed detection window represents a significant concern, as attackers maintained undetected administrative access throughout the period.

JFrog Artifactory functions as a repository manager for software build outputs and dependencies used across development teams. The vulnerability exploited in this incident allowed complete system compromise without requiring valid credentials, enabling attackers to modify stored packages, extract stored credentials, and alter system integrations—creating multiple vectors for downstream impact.