alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS JFrog Self-Managed Artifactory Authentication Bypass (CVE-2026-82329)"; flow:established,to_server; http.uri; content:"/access/api/v1/registry/join"; fast_pattern; http.content_type; content:"text/plain"; http.request_body; content:"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9|2e|"; pcre:"/^[^\x2e]*?(?:UzYjBjNDQyOThmYzFjMTQ5YWZiZjRjODk5NmZiOTI0MjdhZTQxZTQ2NDliOTM0Y2E0OTU5OTFiNzg1MmI4NT|ZTNiMGM0NDI5OGZjMWMxNDlhZmJmNGM4OTk2ZmI5MjQyN2FlNDFlNDY0OWI5MzRjYTQ5NTk5MWI3ODUyYjg1N|lM2IwYzQ0Mjk4ZmMxYzE0OWFmYmY0Yzg5OTZmYjkyNDI3YWU0MWU0NjQ5YjkzNGNhNDk1OTkxYjc4NTJiODU1)/R"; http.method; content:"POST"; reference:url,bishopfox.com/blog/cve-2026-82329-unauthenticated-administrative-access-in-jfrog-artifactory-via-an-empty-cluster-join-key; reference:cve,2026-82329; classtype:web-application-attack; sid:2072399; rev:1; metadata:affected_product JFrog, attack_target Server, tls_state TLSDecrypt, created_at 2026_10_08, cve CVE_2026_82329, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2026_10_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)