EN PT-BR
← Voltar ao feed
high

Sonatype Patches Critical SSO Bypass and Six Other Flaws in Nexus Repository 3 (CVE-2026-113373)

1 fonte(s) · 1 atualização(ões) · publicado 05/11/2026 22:00 · coletado há 2 horas

Sonatype released version 3.98.0 of Nexus Repository 3 fixing seven vulnerabilities tracked from CVE-2026-113368 to CVE-2026-113374, affecting both the Community Edition (CE) and Pro editions. The most severe, CVE-2026-113373 (CVSS 9.1, critical), is an authentication weakness in the Pro edition where the server fails to verify whether a locally disabled or locked account is still active when a user signs in through SAML or OAuth2/OpenID Connect, allowing a previously locked user to regain a full session with all prior roles. Sonatype states that no active exploitation or public exploit tools exist for any of the seven flaws. Because Nexus Repository centralizes software packages, container images, and signing keys for build pipelines, these bugs expose software supply chains and build secrets to elevated risk if left unpatched.

Entenda a falha

A vulnerabilidade

Sonatype Nexus Repository 3 (CE and Pro) had seven flaws, CVE-2026-113368 to CVE-2026-113374, all fixed in 3.98.0. The worst is CVE-2026-113373 (CVSS 9.1, Pro only, 3.86.0 to 3.97.x): a locked or disabled local account can sign back in through SAML or OAuth2/OIDC and regain all its old roles. CVE-2026-113374 (8.6, CWE-862, 3.0.0 to before 3.98.0) lets a user with only nexus:capabilities:create enable a Rut Auth header-login rule, after which a remote attacker can log in as any user, admin included, without a password. CVE-2026-113370 (7.7, SQL injection, 3.90.0 to 3.97.x) needs a non-default setting and task-creation rights. CVE-2026-113371 and CVE-2026-113372 (7.1, 3.93.0 to before 3.98.0) leak signing secrets to read-admin accounts. CVE-2026-113369 (6.3, stored XSS in hosted OCI repos, 3.94.0 to before 3.98.0) and CVE-2026-113368 (5.3, private repos added to a group) are the lower-severity ones.

Como funciona

For CVE-2026-113373, a user authenticates at an external identity provider through SAML or OAuth2/OIDC and the identity is passed to Nexus. Nexus maps it to a local account and opens a session with that account's roles, but it does not check whether the local account is locked or disabled. For CVE-2026-113374, creating a capability for the Rut Auth rule is accepted from a user who lacks realm administration rights. Once the header-login rule is active, Nexus trusts the identity in the incoming request header. For CVE-2026-113370, the filter field of the Reindex Search Tables By Pattern task is placed into a database query. For CVE-2026-113369, a manifest field of an OCI image is stored and later rendered in the admin's Attestations tab.

Por que é vulnerável

The flaws come from missing checks. CVE-2026-113373 is classed as CWE-1390 (weak authentication): the SSO login path skips the locked or disabled account state. CVE-2026-113374 is a missing authorization check (CWE-862) when the Rut Auth rule is created. CVE-2026-113370 is unsanitized input in a SQL query (CWE-89). CVE-2026-113371 and CVE-2026-113372 expose secrets (CWE-522) to accounts with only read-admin rights. CVE-2026-113369 is output not neutralized in a web page (CWE-79). The articles do not explain why they went unnoticed or detail the code changes, apart from 3.98.0 also disabling stored script execution by default unless nexus.scripts.allowExecution=true is set.

Onde está

The articles name no files, functions or commits; they only mention the Reindex Search Tables By Pattern task, the setting nexus.reindex.search.by.pattern.visible, an internal REST route for the APT/YUM passphrase, and the OCI Attestations tab.

Como foi descoberta

The articles do not say who found the flaws or how. They only report that Sonatype released 3.98.0 with the fixes and an advisory, and that Sonatype states there is no active exploitation in the wild.

Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 23:17.

Detalhes técnicos

CVE-2026-113374 (CVSS 8.6, high, CWE-862) lets a user holding only the nexus:capabilities:create privilege enable a Rut Auth header-login rule without realm administrator rights, after which a remote attacker can authenticate as any existing user, including an admin, without a password. CVE-2026-113368 (CVSS 5.3) allows a user with group-edit rights to add private repositories to a group they control, exposing restricted content. CVE-2026-113370 (CVSS 7.7, CWE-89) is a SQL injection in the optional “Reindex Search Tables By Pattern” task, exploitable only when the non-default setting nexus.reindex.search.by.pattern.visible is enabled, by a user holding task-creation rights. CVE-2026-113372 and CVE-2026-113371 (both CVSS 7.1, CWE-522) leak the private signing key of YUM proxy/group repositories and the signing passphrase for APT/YUM repositories respectively, to accounts with only read-admin privileges. CVE-2026-113369 (CVSS 6.3, CWE-79) is a stored XSS in hosted OCI repositories, where a user with OCI edit rights can inject script into an image manifest field that executes in an admin's browser when viewing the Attestations tab. Affected version ranges vary by flaw: CVE-2026-113374 and CVE-2026-113368 affect all CE/Pro builds from 3.0.0 before 3.98.0; CVE-2026-113373 affects only Pro builds 3.86.0 through 3.97.x; CVE-2026-113370 affects 3.90.0 through 3.97.x; CVE-2026-113371 and CVE-2026-113372 affect 3.93.0 before 3.98.0; and CVE-2026-113369 affects 3.94.0 before 3.98.0.

Remediação

Administrators should upgrade Nexus Repository 3 to version 3.98.0 or later immediately. Version 3.98.0 also disables stored script execution by default unless nexus.scripts.allowExecution=true is explicitly set. Upgrading alone does not remediate secrets or configurations compromised before patching, so teams should review login logs for reactivated locked SSO accounts, remove rogue Rut Auth rules or realms, rotate any signing keys and passphrases that were exposed to untrusted read-admin users, audit group repository membership, and restrict task-creation, capability-creation, and OCI edit privileges to trusted staff.

Linha do tempo

  1. securityonline.info ↗ · pub. 05/11/2026 22:00 · coletado 05/11 23:00 primeiro registro

    Sonatype Patches Critical SSO Bypass and Six Other Flaws in Nexus Repository 3 (CVE-2026-113373)

    ler a análise desta fonte

    Sonatype released version 3.98.0 of Nexus Repository 3 fixing seven vulnerabilities tracked from CVE-2026-113368 to CVE-2026-113374, affecting both the Community Edition (CE) and Pro editions. The most severe, CVE-2026-113373 (CVSS 9.1, critical), is an authentication weakness in the Pro edition where the server fails to verify whether a locally disabled or locked account is still active when a user signs in through SAML or OAuth2/OpenID Connect, allowing a previously locked user to regain a full session with all prior roles. Sonatype states that no active exploitation or public exploit tools exist for any of the seven flaws. Because Nexus Repository centralizes software packages, container images, and signing keys for build pipelines, these bugs expose software supply chains and build secrets to elevated risk if left unpatched.

    Technical Details

    CVE-2026-113374 (CVSS 8.6, high, CWE-862) lets a user holding only the nexus:capabilities:create privilege enable a Rut Auth header-login rule without realm administrator rights, after which a remote attacker can authenticate as any existing user, including an admin, without a password. CVE-2026-113368 (CVSS 5.3) allows a user with group-edit rights to add private repositories to a group they control, exposing restricted content. CVE-2026-113370 (CVSS 7.7, CWE-89) is a SQL injection in the optional “Reindex Search Tables By Pattern” task, exploitable only when the non-default setting nexus.reindex.search.by.pattern.visible is enabled, by a user holding task-creation rights. CVE-2026-113372 and CVE-2026-113371 (both CVSS 7.1, CWE-522) leak the private signing key of YUM proxy/group repositories and the signing passphrase for APT/YUM repositories respectively, to accounts with only read-admin privileges. CVE-2026-113369 (CVSS 6.3, CWE-79) is a stored XSS in hosted OCI repositories, where a user with OCI edit rights can inject script into an image manifest field that executes in an admin's browser when viewing the Attestations tab. Affected version ranges vary by flaw: CVE-2026-113374 and CVE-2026-113368 affect all CE/Pro builds from 3.0.0 before 3.98.0; CVE-2026-113373 affects only Pro builds 3.86.0 through 3.97.x; CVE-2026-113370 affects 3.90.0 through 3.97.x; CVE-2026-113371 and CVE-2026-113372 affect 3.93.0 before 3.98.0; and CVE-2026-113369 affects 3.94.0 before 3.98.0.

    Remediation

    Administrators should upgrade Nexus Repository 3 to version 3.98.0 or later immediately. Version 3.98.0 also disables stored script execution by default unless nexus.scripts.allowExecution=true is explicitly set. Upgrading alone does not remediate secrets or configurations compromised before patching, so teams should review login logs for reactivated locked SSO accounts, remove rogue Rut Auth rules or realms, rotate any signing keys and passphrases that were exposed to untrusted read-admin users, audit group repository membership, and restrict task-creation, capability-creation, and OCI edit privileges to trusted staff.