Summary
- Attackers compromised OpenInfra Europe’s self-hosted JFrog Artifactory instance after exploiting CVE-2026-82329.
- Artefacts downloaded between 28 August and 15 September should be removed from pipelines and treated as potentially compromised.
- The organisation has not established that every package was altered, but the repository’s administrative integrity can no longer be assumed for the affected period.
OpenInfra Europe has told organisations to stop using software artefacts downloaded from a compromised repository after attackers gained administrative access to its self-hosted JFrog Artifactory instance.
The European open infrastructure organisation said anyone who downloaded or installed material from artifactory.nordix.org between 28 August and 15 September should remove it from development pipelines and treat the packages as potentially compromised.
The warning does not establish that every package distributed during the period was altered. OpenInfra Europe says the full scope and impact remain under investigation, leaving users with a software supply chain problem in which the integrity of affected artefacts cannot currently be guaranteed.
The organisation says the Artifactory instance was running a vulnerable version that exposed CVE-2026-82329, an authentication bypass vulnerability capable of giving an unauthenticated attacker administrative access. The flaw was publicly disclosed on 28 August and subsequently added to the US Cybersecurity and Infrastructure Security Agency’s catalogue of known exploited vulnerabilities.
OpenInfra Europe dates the compromise to 31 August. It detected the breach on 15 September after a legitimate user was denied access, then isolated the affected system and began an investigation.
That two-week interval is particularly consequential for a software repository. Artifactory services store and distribute build outputs, dependencies, and other artefacts used by development teams. Administrative access can expose not only packages but also credentials, integrations, repository configuration, and the systems that depend on them.
There is currently no public evidence identifying a particular malicious package served by the repository. The more immediate problem is provenance: once the distribution system itself has been under unauthorised administrative control, users need to establish which artefacts entered their own build or deployment chains during the affected period.
That can extend well beyond deleting a downloaded package. If an artefact was incorporated into another build, copied into an internal registry, or deployed to production, organisations may need to trace the resulting dependency chain and replace derived components with material obtained from a trusted source.
The incident also illustrates why software supply chain risk reaches beyond source-code repositories. Binary repositories, package registries, build systems, signing infrastructure, and continuous integration services all sit between source code and deployed software. Their security determines whether organisations can trust what eventually reaches production.
OpenInfra Europe is a Brussels-based regional hub supported by the OpenInfra Foundation and works with communities responsible for widely deployed open infrastructure technologies. That gives the compromise potential relevance beyond the affected server, particularly for organisations consuming artefacts through collaborative development environments.
The evidence does not yet support claims of a broad downstream compromise. It does establish that a trusted distribution point was under attacker control and that OpenInfra Europe cannot currently provide normal integrity assurance for material downloaded during the stated window.
The investigation will need to establish whether packages, credentials, or integrations were changed. Until then, organisations that consumed affected artefacts face a tracing and validation exercise rather than a conventional patch-only response.
