OpenInfra Europe, the European arm of the open-source OpenInfra Foundation, has disclosed that attackers compromised its self-hosted JFrog Artifactory server and warned that packages downloaded from it may be tainted, Help Net Security reported Wednesday. The intruders exploited an Artifactory flaw disclosed only three days before the breach, and the compromise was not discovered until mid-September.

What Happened

The affected system is the Artifactory instance at artifactory.nordix.org, which OpenInfra Europe uses as a binary repository to store build outputs and software dependencies. Attackers broke in by exploiting CVE-2026-82329, an authentication bypass in JFrog Artifactory that lets an unauthenticated user gain administrator access. The instance had not been patched.

The timeline set out in the notice is short at the front end and long at the back:

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts
  • Aug. 28: CVE-2026-82329 was publicly disclosed.
  • Aug. 31: exploitation in the wild began, and OpenInfra Europe's server was compromised.
  • Sept. 2: CISA added the flaw to its Known Exploited Vulnerabilities catalog.
  • Sept. 15: the breach was discovered after a legitimate user found they could no longer log in.
  • Sept. 30: OpenInfra Europe published its security notice.

The organization isolated the system when the intrusion was found. It said the full scope and impact are still being determined.

Why It Matters

A binary repository sits upstream of everything that pulls from it. With admin rights, an attacker can in principle replace or modify stored artifacts, and any continuous integration pipeline that fetches them can carry the change into downstream software without anyone rebuilding from source. That is why OpenInfra Europe is telling anyone who downloaded or installed artifacts from the server between Aug. 28 and Sept. 15 to stop using them at once, remove them from their pipelines and treat them as potentially compromised. The window starts on the disclosure date, not the breach date, a conservative choice given that exploitation began within days.

The case also shows how little time maintainers get after a disclosure. The gap between public disclosure and a working compromise here was three days, and the flaw entered CISA's exploited-vulnerability list two days after that. A self-hosted service that is not patched in that period is exposed, and in this case the intruders were inside for roughly two weeks before a failed login by a real user gave them away.

Context

The OpenInfra Foundation is a Linux Foundation non-profit best known as the home of OpenStack, the open-source cloud infrastructure software used by telecom operators and private-cloud builders. JFrog Artifactory is widely used across the industry to store and distribute compiled software, container images and dependencies, which makes authentication flaws in it attractive to attackers seeking access to many build environments at once.

What to Watch

The key unanswered question is whether any artifacts were actually changed during the roughly two-week window, and if so which ones. Downstream users of Nordix-hosted artifacts will need to audit their pipelines and rebuild or re-verify affected components while that answer is pending. Further detail from OpenInfra Europe on what the attackers accessed, and whether other self-hosted Artifactory instances were hit through the same flaw in the same period, would help organizations judge their own exposure.