OpenInfra Europe’s JFrog Artifactory instance breached, packages potentially compromised

OpenInfra Europe, the European arm of the OpenInfra Foundation that backs projects like OpenStack, has disclosed that its self-hosted JFrog Artifactory repository at artifactory.nordix.org was breached. The group is urging anyone who pulled artifacts from that server between August 28 and September 15, 2026 to treat them as potentially tampered with, pull them from build pipelines immediately, and stop relying on them.

According to the notice, attackers exploited CVE-2026-82329, an authentication-bypass flaw in JFrog Artifactory that let unauthenticated actors obtain administrator rights and manipulate stored packages, credentials and integrations. JFrog disclosed the bug on August 28, 2026, CISA added it to its Known Exploited Vulnerabilities list on September 2, and outside researchers report active exploitation starting August 31 — matching when OpenInfra Europe says its own instance was first compromised.

The organization says it only noticed the intrusion on September 15, after a legitimate user was locked out, prompting it to isolate the server and launch an investigation whose full scope remains unclear. Any team consuming artifacts from this repository during the exposure window should audit their pipelines and rotate affected credentials as a precaution.