Sonatype Nexus Security Advisory
Date: November 4, 2026
Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.93.0 up to, but not including, 3.98.0
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.98.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N = 7.1 (High)
CWE: CWE-522: Insufficiently Protected Credentials
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-113372
Summary
Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or YUM group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. The repository uses this key to sign its metadata.
At the time of this advisory, Sonatype is not aware of this vulnerability being actively exploited in the wild.
Recommendation
Users are advised to upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.98.0 or later. Downloads are available at https://help.sonatype.com/en/download.html.
The upgrade does not make a key that was exposed before the upgrade safe again. If an account that you do not fully trust held the read privilege for administering a YUM proxy or group repository that has a signing key configured, rotate the signing key pair of that repository. Then update the trust configuration of the clients that use the repository.
Immediate Mitigation Options
There is no configuration change that fully mitigates this vulnerability without upgrading. The following measures reduce exposure:
-
Restrict the privilege: Grant the repository administration read privilege for YUM repositories (
nx-repository-admin-yum-<repository>-read, or wildcard privileges that include it) only to fully trusted accounts. Review the roles and external group mappings that contain them. - Network-level access control: Restrict access to the Nexus Repository web interface and REST API to trusted networks.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker can read the private signing key of a YUM proxy or group repository. A party that holds the private signing key can sign repository metadata as that repository. If the key is also protected by a passphrase, the attacker can try to recover the key without time limits and outside of Nexus Repository.
Q: What preconditions must be met in order to be vulnerable?
A: The instance must have a YUM proxy or group repository with a signing key configured. These repositories are not created by default. The attacker must have network access to the Nexus Repository web interface or REST API. The attacker must hold the read privilege for administering that repository (nx-repository-admin-yum-<repository>-read), directly or through a role.
Q: Are there implications associated with this advisory itself?
A: Publishing this advisory may enable malicious actors to attempt to exploit this vulnerability. Affected users should assess their exposure and apply the recommended upgrade or interim mitigation as soon as practicable.
Q: Why is Sonatype making this information available?
A: Sonatype follows responsible disclosure practices. We publish advisories after a fix is available so that users can take informed action to protect their installations.