Skip to main content

Security updates: eMudhra certificate incident and PHP2Shell: Sonatype is aware of the eMudhra certificate incident and the PHP2Shell vulnerabilities. We are updating our products to address the eMudhra issue and have confirmed that Sonatype products are not impacted by PHP2Shell. Read Sonatype's assessment and guidance

CVE-2026-113370 Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task - 2026-11-04

Updated

Sonatype Nexus Security Advisory

Date: November 4, 2026

Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.90.0 up to and including 3.97.x

Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.98.0

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = 7.7 (High)

CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)

Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-113370

Summary

A SQL injection vulnerability in Sonatype Nexus Repository 3 exists in the optional “Reindex Search Tables By Pattern” task. A user who can create tasks can supply a crafted filter condition. The database runs this condition as SQL. The user can then change data in the Nexus database.

The user must have signed in with valid credentials and must hold the nexus:tasks:create privilege. The task is available only when the setting nexus.reindex.search.by.pattern.visible=true is set. This setting is off by default.

At the time of this advisory, Sonatype is not aware of this vulnerability being actively exploited in the wild.

Recommendation

Users are advised to upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.98.0 or later. Downloads are available at https://help.sonatype.com/en/download.html.

In version 3.98.0, the task no longer accepts a free-form filter condition. A task that was saved with a free-form filter condition runs a fixed filter after the upgrade.

Version 3.98.0 also turns script execution off by default. If you use stored scripts, set nexus.scripts.allowExecution=true after the upgrade.

After you upgrade, review the list of scheduled tasks and the users and roles that hold the nexus:tasks:create privilege. Remove any task or privilege that you do not expect.

Immediate Mitigation Options

The following measures reduce exposure for installations that cannot upgrade immediately:

  • Keep the task hidden: Make sure the setting nexus.reindex.search.by.pattern.visible is not set to true. The default value is false. When the value is false, the task cannot be created.
  • Restrict the privilege: Grant the nexus:tasks:create privilege (for example through the nx-tasks-create privilege or any role that contains it) only to fully trusted administrators.
  • Review existing tasks: Check the scheduled tasks for “Reindex Search Tables By Pattern” tasks that you did not create.

Credit

This issue was discovered and reported responsibly by Shreyas Chavhan (HackerOne: shreyaschavhan) via Sonatype’s Bug Bounty Program.

Frequently Asked Questions

Q: What is the risk associated with this vulnerability?
A: An attacker can change data in the Nexus database. This data includes scheduled task definitions. Depending on the configuration of the installation, this can lead to the execution of code on the server with the privileges of the Nexus service account.

Q: What preconditions must be met in order to be vulnerable?
A: The attacker must have network access to the Nexus Repository web interface or REST API. The attacker must use an account that has signed in with valid credentials and holds the nexus:tasks:create privilege, directly or through a role. The setting nexus.reindex.search.by.pattern.visible=true must be set.

Q: Are there implications associated with this advisory itself?
A: Publishing this advisory may enable malicious actors to attempt to exploit this vulnerability. Affected users should assess their exposure and apply the recommended upgrade or interim mitigation as soon as practicable.

Q: Why is Sonatype making this information available?
A: Sonatype follows responsible disclosure practices. We coordinate with security researchers who report vulnerabilities to us in good faith, and we publish advisories after a fix is available so that users can take informed action to protect their installations.

Related articles