Sonatype Nexus Security Advisory
Date: November 4, 2026
Affected Versions: Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 up to and including 3.97.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.98.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N = 8.6 (High)
CWE: CWE-862: Missing Authorization
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-113374
Summary
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability. This turns on header-based authentication for the instance. After that, a remote client can authenticate as an existing user, including an administrator, without credentials.
We are not aware of active exploitation of this vulnerability at the time of this announcement.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.98.0 or later. You can download the latest version from https://help.sonatype.com/en/download.html.
After you upgrade, creating, updating, or enabling a Rut Auth capability requires the nexus:settings:update permission in addition to the capabilities permission. The upgrade does not remove capabilities that already exist. After you upgrade, do the following:
- Review the list of capabilities. If you do not use Rut Auth, delete any Rut Auth capability. If you use Rut Auth, confirm that an administrator created it on purpose.
- Review the list of active realms in your security settings. If you do not use Rut Auth, remove the Rut Auth realm.
- If you find a Rut Auth capability or realm that you did not set up, treat the activity on the instance as suspect and review it.
Immediate Mitigation Options
If you cannot upgrade now, do the following:
- Grant the capability privileges (
nx-capabilities-*) only to trusted administrators. Treat these privileges as equal to administrator access. - Review which roles and users hold these privileges, and remove them from all other accounts.
- Do the capability and realm review that is described in the Recommendation section.
Credit
This issue was discovered and reported responsibly by 0xoroot-sec (GitHub handle) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker can act as any existing user, including an administrator. An administrator can read and change repositories, users, roles, and settings, and can publish or replace components. After the capability exists, the attacker does not need an account on the instance.
Q: What preconditions must be met in order to be vulnerable?
A: You run Sonatype Nexus Repository 3 CE or Pro in an affected version. An account on the instance holds the nexus:capabilities:create permission (for example through the nx-capabilities-create privilege), but does not hold administrator access. That account creates the Rut Auth capability. Remote clients must be able to reach the instance over the network.
Q: Are there implications associated with this advisory itself?
A: Public disclosure of a vulnerability can make it easier for malicious actors to find and target unpatched systems. We recommend that you assess the impact on your environment and take the actions in this advisory as soon as possible.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process. We publish this advisory after a fix is available, so that customers can protect their systems and make informed decisions about risk.