Read the docs
TI-2026-85146 Aliases CVE-2026-113370GHSA-mh47-h7w3-hwfx

SQL injection in Nexus Repository 3 reindex search task

Priority LOW 33CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Sonatype Nexus Repository 3 from 3.90.0 before 3.98.0 contains an SQL injection flaw (CWE-89) in the optional Reindex Search Tables By Pattern task. A user with the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL, which lets the user modify data in the Nexus database. The task is only visible when the non-default setting nexus.reindex.search.by.pattern.visible is true.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.

Why it matters now

EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed Nexus Repository 3 (Sonatype): 3.98.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SonatypeNexus Repository 33.90.0 to before 3.98.03.98.0Patch availableCNA
  • Nexus Repository 3 VendorSonatype Affected 3.90.0 to before 3.98.0 Fixed in 3.98.0 Patch available CNA

CPE names CNA · 30

CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0:*:*:*:*:*:*:*3.90.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1:*:*:*:*:*:*:*3.90.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2:*:*:*:*:*:*:*3.90.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3:*:*:*:*:*:*:*3.90.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4:*:*:*:*:*:*:*3.90.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.5:*:*:*:*:*:*:*3.90.5—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0:*:*:*:*:*:*:*3.91.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1:*:*:*:*:*:*:*3.91.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.0:*:*:*:*:*:*:*3.92.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1:*:*:*:*:*:*:*3.92.1—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0:*:*:*:*:*:*:* Versions 3.90.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1:*:*:*:*:*:*:* Versions 3.90.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2:*:*:*:*:*:*:* Versions 3.90.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3:*:*:*:*:*:*:* Versions 3.90.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4:*:*:*:*:*:*:* Versions 3.90.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.5:*:*:*:*:*:*:* Versions 3.90.5 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0:*:*:*:*:*:*:* Versions 3.91.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1:*:*:*:*:*:*:* Versions 3.91.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.92.0:*:*:*:*:*:*:* Versions 3.92.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1:*:*:*:*:*:*:* Versions 3.92.1 — ·Sonatype
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2:*:*:*:*:*:*:*3.92.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3:*:*:*:*:*:*:*3.92.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*3.93.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*3.93.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*3.93.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*3.94.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*3.94.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*3.94.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*3.95.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*3.95.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*3.95.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*3.95.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*3.95.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*3.96.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*3.96.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*3.96.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*3.96.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*3.96.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*3.97.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*3.97.1—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2:*:*:*:*:*:*:* Versions 3.92.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3:*:*:*:*:*:*:* Versions 3.92.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:* Versions 3.93.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:* Versions 3.93.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:* Versions 3.93.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:* Versions 3.94.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:* Versions 3.94.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:* Versions 3.94.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:* Versions 3.95.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:* Versions 3.95.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:* Versions 3.95.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:* Versions 3.95.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:* Versions 3.95.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:* Versions 3.96.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:* Versions 3.96.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:* Versions 3.96.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:* Versions 3.96.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:* Versions 3.96.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:* Versions 3.97.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:* Versions 3.97.1 — ·Sonatype

Remediation

Upgrade Sonatype Nexus Repository 3 to version 3.98.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Nexus Repository 3 (Sonatype) Fixed in 3.98.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sonatype Nexus Repository 3 3.98.0

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-85149 Disabled Nexus Repository 3 accounts can sign in through single sign-onPriority LOW 39
    • TI-2026-85150 Privilege escalation in Nexus Repository 3 via Rut Auth capabilityPriority LOW 37
    • TI-2026-85148 Nexus Repository 3 exposes YUM repository signing keys to read usersPriority LOW 31
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-113370
  2. 2026-11-04 Alias added: GHSA-mh47-h7w3-hwfx
  3. 2026-11-06 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

  • TI-2019-05133 Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-08218 Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). KEVCVSS 3.1HIGH 8.8
  • TI-2020-08220 Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. CVSS 3.1HIGH 7.2
  • TI-2024-04604 Nexus Repository 3 - Path Traversal CVSS 3.1HIGH 7.5
  • TI-2019-03883 OS command injection in Nexus Repository Manager CVSS 3.0HIGH 8.8
  • TI-2026-02763 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection CVSS 4.0CRITICAL 9.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences