CVE-2026-113371

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113371", "assignerOrgId": "103e4ec9-0a87-450b-af77-479448ddef11", "state": "PUBLISHED", "assignerShortName": "Sonatype", "dateReserved": "2026-10-20T01:54:48.996Z", "datePublished": "2026-11-04T20:01:20.078Z", "dateUpdated": "2026-11-09T21:02:28.139Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "103e4ec9-0a87-450b-af77-479448ddef11", "shortName": "Sonatype", "dateUpdated": "2026-11-04T20:01:20.078Z"}, "title": "Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "type": "CWE"}]}], "affected": [{"vendor": "Sonatype", "product": "Nexus Repository 3", "versions": [{"status": "affected", "version": "3.93.0", "lessThan": "3.98.0", "versionType": "semver"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.</p>"}]}], "references": [{"url": "https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html", "tags": ["patch"]}, {"url": "https://support.sonatype.com/hc/en-us/articles/56609541356051/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Ho Boon Suan", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T21:00:25.228845Z", "id": "CVE-2026-113371", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T21:02:28.139Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-113371", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T21:00:25.228845Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T21:01:23.743Z"}}], "cna": {"title": "Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ho Boon Suan"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*"], "vendor": "Sonatype", "product": "Nexus Repository 3", "versions": [{"status": "affected", "version": "3.93.0", "lessThan": "3.98.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html", "tags": ["patch"]}, {"url": "https://support.sonatype.com/hc/en-us/articles/56609541356051/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.", "supportingMedia": [{"type": "text/html", "value": "<p>Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "103e4ec9-0a87-450b-af77-479448ddef11", "shortName": "Sonatype", "dateUpdated": "2026-11-04T20:01:20.078Z"}}}, "cveMetadata": {"cveId": "CVE-2026-113371", "state": "PUBLISHED", "dateUpdated": "2026-11-09T21:02:28.139Z", "dateReserved": "2026-10-20T01:54:48.996Z", "assignerOrgId": "103e4ec9-0a87-450b-af77-479448ddef11", "datePublished": "2026-11-04T20:01:20.078Z", "assignerShortName": "Sonatype"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Nexus Repository 3", "vendor": "Sonatype", "versions": [{"lessThan": "3.98.0", "status": "affected", "version": "3.93.0", "versionType": "semver"}]}], "source": "103e4ec9-0a87-450b-af77-479448ddef11"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository."}], "id": "CVE-2026-113371", "lastModified": "2026-11-09T22:18:24.863", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "103e4ec9-0a87-450b-af77-479448ddef11", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-113371", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T21:00:25.228845Z", "version": "2.0.3"}}]}, "published": "2026-11-04T20:18:56.297", "references": [{"source": "103e4ec9-0a87-450b-af77-479448ddef11", "url": "https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html"}, {"source": "103e4ec9-0a87-450b-af77-479448ddef11", "url": "https://support.sonatype.com/hc/en-us/articles/56609541356051/"}], "sourceIdentifier": "103e4ec9-0a87-450b-af77-479448ddef11", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "103e4ec9-0a87-450b-af77-479448ddef11", "type": "Secondary"}]}

{"bugzilla": {"description": "nexus: Sonatype Nexus Repository: Information disclosure via internal REST endpoint", "id": "2567681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567681"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.", "A flaw was found in Sonatype Nexus Repository. An authenticated user with read-only administrative privileges can trigger sensitive information disclosure through an internal REST (Representational State Transfer) endpoint. The application returns the repository signing passphrase for package repositories without verifying that the requesting user has edit permissions. This exposure could allow an attacker to obtain cryptographic credentials and produce unauthorized signed packages."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-113371", "public_date": "2026-11-04T20:01:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-113371\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-113371\nhttps://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html\nhttps://support.sonatype.com/hc/en-us/articles/56609541356051/"], "statement": "Red Hat has rated this vulnerability as Moderate because exploitation requires an authenticated account that already holds administrative read access to repository configurations. Although unauthorized retrieval of package signing passphrases compromises credential confidentiality and could facilitate rogue package signing, the attack cannot be launched by unauthenticated or unprivileged users. The impact is therefore constrained to environments where repository administrative read permissions are granted to untrusted parties.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.93.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.93.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.93.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.94.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.94.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.94.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.95.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.95.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.95.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.95.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.95.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.96.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.96.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.96.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.96.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.96.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.97.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.97.1"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "nexus_repository_manager", "vendor": "sonatype"}], "created": "2026-11-04T23:15:16.373300+00:00", "updated": "2026-11-06T16:30:07.059326+00:00", "vendors": ["sonatype", "sonatype$PRODUCT$nexus_repository_manager"]}