CVE-2026-113371

CVSS 7.1 (high) · published 2026-11-04

Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.

Weakness: CWE-522

Source: NVD CVE-2026-113371

References

• https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html
• https://support.sonatype.com/hc/en-us/articles/56609541356051/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.