Sonatype Nexus Security Advisory
Date: November 4, 2026
Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.93.0 up to, but not including, 3.98.0
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.98.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N = 7.1 (High)
CWE: CWE-522: Insufficiently Protected Credentials
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-113371
Summary
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. The passphrase protects the private key that the repository uses to sign its metadata.
At the time of this advisory, Sonatype is not aware of this vulnerability being actively exploited in the wild.
Recommendation
Users are advised to upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.98.0 or later. Downloads are available at https://help.sonatype.com/en/download.html.
The upgrade does not change a passphrase that was exposed before the upgrade. If an account that you do not fully trust held the read privilege for administering an APT or YUM repository that has a signing key configured, rotate the signing key pair and passphrase of that repository. Then update the trust configuration of the clients that use the repository.
Immediate Mitigation Options
There is no configuration change that fully mitigates this vulnerability without upgrading. The following measures reduce exposure:
-
Restrict the privilege: Grant the repository administration read privileges for APT and YUM repositories (
nx-repository-admin-apt-<repository>-read,nx-repository-admin-yum-<repository>-read, or wildcard privileges that include them) only to fully trusted accounts. Review the roles and external group mappings that contain them. - Network-level access control: Restrict access to the Nexus Repository web interface and REST API to trusted networks.
Credit
This issue was discovered and reported responsibly by Ho Boon Suan via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker can read the passphrase of the signing key of an APT or YUM repository through an internal REST endpoint. A party that holds both the private signing key and its passphrase can sign repository metadata as that repository.
Q: What preconditions must be met in order to be vulnerable?
A: The instance must have an APT or YUM repository with a signing passphrase configured. These repositories are not created by default. The attacker must have network access to the Nexus Repository web interface or REST API. The attacker must hold the read privilege for administering that repository (nx-repository-admin-apt-<repository>-read or nx-repository-admin-yum-<repository>-read), directly or through a role.
Q: Are there implications associated with this advisory itself?
A: Publishing this advisory may enable malicious actors to attempt to exploit this vulnerability. Affected users should assess their exposure and apply the recommended upgrade or interim mitigation as soon as practicable.
Q: Why is Sonatype making this information available?
A: Sonatype follows responsible disclosure practices. We coordinate with security researchers who report vulnerabilities to us in good faith, and we publish advisories after a fix is available so that users can take informed action to protect their installations.