[ CVE-2026-113374 · Published 4 Nov 2026 ]
Vulnerability in Sonatype Nexus Repository 3
CVSS 8.6
No fix listed yet
[ Description ]Official description
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.