Read the docs
TI-2026-85148 Aliases CVE-2026-113372GHSA-j6jf-w58v-gphw

Nexus Repository 3 exposes YUM repository signing keys to read users

Priority LOW 31CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

Sonatype Nexus Repository 3 from 3.93.0 before 3.98.0 returns the private signing key of YUM proxy and group repositories to accounts that hold only the read privilege for administering the repository (CWE-522). An attacker with low privileges can obtain the key without the privilege needed to edit the repository. Anyone holding the key can sign repository metadata as that repository.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.

Why it matters now

EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed Nexus Repository 3 (Sonatype): 3.98.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SonatypeNexus Repository 33.93.0 to before 3.98.03.98.0Patch availableCNA
  • Nexus Repository 3 VendorSonatype Affected 3.93.0 to before 3.98.0 Fixed in 3.98.0 Patch available CNA

CPE names CNA · 18

CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*3.93.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*3.93.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*3.93.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*3.94.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*3.94.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*3.94.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*3.95.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*3.95.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*3.95.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*3.95.3—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:* Versions 3.93.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:* Versions 3.93.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:* Versions 3.93.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:* Versions 3.94.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:* Versions 3.94.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:* Versions 3.94.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:* Versions 3.95.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:* Versions 3.95.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:* Versions 3.95.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:* Versions 3.95.3 — ·Sonatype
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*3.95.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*3.96.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*3.96.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*3.96.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*3.96.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*3.96.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*3.97.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*3.97.1—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:* Versions 3.95.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:* Versions 3.96.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:* Versions 3.96.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:* Versions 3.96.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:* Versions 3.96.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:* Versions 3.96.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:* Versions 3.97.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:* Versions 3.97.1 — ·Sonatype

Remediation

Upgrade Sonatype Nexus Repository 3 to version 3.98.0, the fixed version listed for this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Nexus Repository 3 (Sonatype) Fixed in 3.98.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sonatype Nexus Repository 3 3.98.0

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-85149 Disabled Nexus Repository 3 accounts can sign in through single sign-onPriority LOW 39
    • TI-2026-85150 Privilege escalation in Nexus Repository 3 via Rut Auth capabilityPriority LOW 37
    • TI-2026-85146 SQL injection in Nexus Repository 3 reindex search taskPriority LOW 33
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-113372
  2. 2026-11-04 Alias added: GHSA-j6jf-w58v-gphw
  3. 2026-11-06 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

  • TI-2019-05133 Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-08218 Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). KEVCVSS 3.1HIGH 8.8
  • TI-2020-08220 Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. CVSS 3.1HIGH 7.2
  • TI-2024-04604 Nexus Repository 3 - Path Traversal CVSS 3.1HIGH 7.5
  • TI-2019-03883 OS command injection in Nexus Repository Manager CVSS 3.0HIGH 8.8
  • TI-2026-02763 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection CVSS 4.0CRITICAL 9.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences