Sonatype Patches Seven Flaws in Nexus Repository 3 Including Critical SSO Bypass
Do Son 
TL;DR
Sonatype released version 3.98.0 of Sonatype Nexus Repository 3 to fix seven security bugs across its software platform. Tracked from CVE-2026-113368 to CVE-2026-113374, the flaws include a critical single sign-on bypass, admin takeover, and SQL injection. Admins must update to version 3.98.0 right away and check their active realm and repo settings.
- Total: 7 CVEs
- Severity: 1 Critical · 4 High · 2 Medium
- Actively exploited: None confirmed
- Highest severity: 9.1 (Critical · CVSSv4) — CVE-2026-113373
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-113373 | 9.1 | Disabled or Locked Single Sign-On Users Can Sign In Again | 3.98.0 | Not exploited |
| CVE-2026-113374 | 8.6 | Privilege Escalation via Rut Auth Capability Creation | 3.98.0 | Not exploited |
| CVE-2026-113370 | 7.7 | SQL Injection in Reindex Search by Pattern Task | 3.98.0 | Not exploited |
| CVE-2026-113371 | 7.1 | Insufficiently Protected Credentials in Repository Signing Passphrase | 3.98.0 | Not exploited |
| CVE-2026-113372 | 7.1 | Insufficiently Protected Credentials in YUM Repository Signing Key | 3.98.0 | Not exploited |
| CVE-2026-113369 | 6.3 | Stored Cross-Site Scripting in OCI Attestations Tab | 3.98.0 | Not exploited |
| CVE-2026-113368 | 5.3 | Group Repository Member Authorization Bypass | 3.98.0 | Not exploited |
Why It Matters
Sonatype Nexus Repository 3 stores software packages, container images, and signing keys for build teams around the world. Therefore, bugs in this central hub put software supply chains and build secrets at high risk.
Currently, Sonatype reports that no active attacks in the wild or public exploit tools exist for any of these bugs. Although exact install counts remain private, industry estimates show that over 100,000 firms use Nexus to manage their build files.
How the Attack Works
Authentication Bypass and Privilege Escalation
First, the worst flaw is CVE-2026-113373 (CVSS 9.1), a weak login check (CWE-1390) in the Pro edition. When a user signs in via SAML or OAuth2, the server fails to check if the local account is locked. As a result, a locked user who still holds valid login provider details can sign back in. They then get a fresh session with all of their old roles.
Second, CVE-2026-113374 (CVSS 8.6) stems from missing auth checks (CWE-862) when a user creates a Rut Auth rule. A user with only the nexus:capabilities:create right can turn on header logins without holding realm admin rights. Once active, a remote attacker can log in as any existing user, including an admin, with no password. Similarly, CVE-2026-113368 (CVSS 5.3) lets a user with group edit rights add private repos to a group. Consequently, they can read restricted files through that group.
SQL Injection, Stored XSS, and Key Exposure
Third, CVE-2026-113370 (CVSS 7.7) is a SQL injection bug (CWE-89) in the “Reindex Search Tables By Pattern” task. This task is off by default unless an admin sets nexus.reindex.search.by.pattern.visible to true. When enabled, a user with task creation rights can put SQL code into the filter field and change database records.
Fourth, two high-risk flaws leak repo signing secrets (CWE-522) to accounts that only hold read admin rights. Specifically, CVE-2026-113372 (CVSS 7.1) returns the private signing key of a YUM proxy or group repo. Likewise, CVE-2026-113371 (CVSS 7.1) leaks the signing passphrase for APT or YUM repos through an internal REST route. Finally, CVE-2026-113369 (CVSS 6.3) allows stored cross-site scripting (CWE-79) in hosted OCI repos. A user with OCI edit rights can store script code in an image manifest field. That script then runs in the browser of any admin who opens the Attestations tab.
Affected Versions
These seven bugs affect multiple branches of Sonatype Nexus Repository 3 Community Edition (CE) and Pro before version 3.98.0. Specifically, CVE-2026-113374 and CVE-2026-113368 hit all CE and Pro builds from 3.0.0 before 3.98.0. Meanwhile, CVE-2026-113373 affects only Pro builds from 3.86.0 through 3.97.x.
Furthermore, the SQL injection bug (CVE-2026-113370) impacts versions 3.90.0 through 3.97.x. The key and passphrase leaks (CVE-2026-113371 and CVE-2026-113372) hit versions 3.93.0 before 3.98.0. Lastly, the OCI script flaw (CVE-2026-113369) affects versions 3.94.0 before 3.98.0.
Patch and Mitigation Steps
Admins should update Sonatype Nexus Repository 3 to version 3.98.0 or later right away. Note that version 3.98.0 also turns off stored script runs by default unless admins set nexus.scripts.allowExecution=true. However, updating alone does not clean up leaked keys or rogue settings made before the patch.
Therefore, security teams must run several checks after the update. First, admins should check login logs for locked SSO users and delete any rogue Rut Auth rules or realms. Second, if untrusted users held read admin rights on APT or YUM repos, teams must rotate those signing keys and passphrases. Finally, admins should check group repo members and limit task, capability, and OCI edit rights to trusted staff.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
