Multiple security vulnerabilities have been identified in Nexus Repository 3, affecting software repository management, authentication, authorization, and repository signing functions. Reported affected versions include 3.90.0 and 3.94.0, with flaws spanning critical, high, and medium severity. The issues can allow authentication bypass, privilege escalation, data manipulation, credential exposure, and script execution, creating significant risk to build infrastructure and software supply chains. No active exploitation has been confirmed.
CVE-2026-113373 (CVSS 9.1 — Critical): A flawed login check in the single sign-on authentication component allows a locked local account to regain access when the user still has valid external identity provider credentials. An attacker who controls or can use such an account can obtain a new session with the account's existing roles.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Nexus Repository 3, affecting software repository management, authentication, authorization, and repository signing functions. Reported affected versions include 3.90.0 and 3.94.0, with flaws spanning critical, high, and medium severity. The issues can allow authentication bypass, privilege escalation, data manipulation, credential exposure, and script execution, creating significant risk to build infrastructure and software supply chains. No active exploitation has been confirmed.
CVE-2026-113373 (CVSS 9.1 — Critical): A flawed login check in the single sign-on authentication component allows a locked local account to regain access when the user still has valid external identity provider credentials. An attacker who controls or can use such an account can obtain a new session with the account's existing roles.[emaillocker id="1283"]
CVE-2026-113368 (CVSS 5.3 — Medium): An authorization bypass in group repository membership handling lets a user with group edit rights add private repositories to a group. The user can then read restricted repository content through that group membership.
CVE-2026-113374 (CVSS 8.6 — High): Missing authorization checks in authentication capability creation allow a user with only capability creation rights to enable header-based login without administrator privileges. A remote attacker can then authenticate as any existing user, including an administrator, without a password.
CVE-2026-113370 (CVSS 7.7 — High): A SQL injection flaw in the reindex search by pattern task allows a user with task creation rights to inject database commands through the filter field when the task is enabled. The attacker can modify database records associated with the repository search function.
CVE-2026-113371 (CVSS 7.1 — High): Insufficient protection of repository signing credentials exposes the signing passphrase for APT or YUM repositories through an internal endpoint. An account with read administrator rights can retrieve the passphrase and compromise repository signing operations.
CVE-2026-113372 (CVSS 7.1 — High): Insufficient protection of repository signing credentials exposes the private signing key for a YUM proxy or group repository through an internal endpoint. An account with read administrator rights can obtain the key and forge or tamper with signed repository content.
CVE-2026-113369 (CVSS 6.3 — Medium): Stored cross-site scripting in hosted OCI repository attestations allows a user with OCI edit rights to embed script code in an image manifest field. The script executes in the browser of an administrator who views the affected attestations page.
These vulnerabilities collectively present a severe risk to organizations that rely on a central repository for software packages, container images, and signing keys. The greatest exposure belongs to deployments where untrusted users hold administrative, editing, or read administrator rights, because the flaws can lead to account takeover, privilege escalation, and exposure of signing secrets. Organizations should prioritize assessment of authentication, authorization, and repository access controls on affected systems.
We recommend you to update Sonatype Nexus Repository 3 to version 3.98.0.
The following reports contain further technical details:
[/emaillocker]