{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "Variant entry points for CVE-2026-82329: unauthenticated POST /access/api/v1/registry/join/router (and ?override=true) plus POST /access/api/v1/registry/join with explicit kid=sha256('') claim, on artifactory-jcr 7.146.25; blank-join-key HMAC JWT accepted, scp=admin service token extracted (router variant: from 'token' claim of the wrapper JWT) and used for admin takeover via /access/api/v1/users + /access/api/v1/tokens + /artifactory/api/system/info. Same attacks against fixed 7.146.38 rejected with HTTP 400.",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "docker (rootless)",
    "postgres:16-alpine",
    "releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.25 (vulnerable)",
    "releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.38 (fixed)"
  ],
  "target_identity": {
    "repository_url": "https://releases-docker.jfrog.io/jfrog/artifactory-jcr",
    "commit_sha": null,
    "target_digest": "docker-image:releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.25@sha256:1734bd9277874ce6a29239fbbe0fe21befa9588ba59b21f724deaee77a4f9c57",
    "runtime_digest": "docker-image:releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.38@sha256:a94c9a8e27a6542bdca359a928cbb50f6aa2732c135291a13e17bde3a5c3996b",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "artifacts/variant_http/vuln_router.json",
    "artifacts/variant_http/vuln_router-override.json",
    "artifacts/variant_http/vuln_join-kid.json",
    "artifacts/variant_http/fixed_router.json",
    "artifacts/variant_http/fixed_router-override.json",
    "artifacts/variant_http/fixed_join-kid.json",
    "logs/vuln_variant/reproduction_steps.log",
    "logs/vuln_variant/vuln_version.txt",
    "logs/vuln_variant/fixed_version.txt"
  ],
  "runs": [
    {"run": 2, "vuln": {"router": 0, "router-override": 0, "join-kid": 0}, "fixed": {"router": 1, "router-override": 1, "join-kid": 1}, "script_exit": 1},
    {"run": 3, "vuln": {"router": 0, "router-override": 0, "join-kid": 0}, "fixed": {"router": 1, "router-override": 1, "join-kid": 1}, "script_exit": 1}
  ],
  "notes": "exit 0 of the variant script is reserved for a true bypass (variant reproduces on the FIXED build); all three variants exploit the vulnerable build and are blocked on the fixed build, hence exit 1. rc=0 per variant = full admin takeover demonstrated (zero credentials). Run 1 of the script had a verdict-parsing bug (tee output captured into the results variable, timestamps containing ':0' triggered a false BYPASS match); fixed before runs 2-3."
}