CVE-2026-113374highCWE-862

CVE-2026-113374: falha de alta gravidade em Sonatype Nexus Repository 3

Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation

Publicada em

Seguir esta CVE+ Monitorar Nexus Repository

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.3%
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Sonatype · Nexus Repository 3
CVEs relacionadas — Sonatype Nexus Repository 3

No mesmo produto, das mais perigosas para as menos.

CVE-2026-17594HIGHNexus Repository 3 - Authorization Bypass in Repository CreationEPSS 1.0%CVE-2026-17603HIGHNexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration APIEPSS 0.9%CVE-2026-77124HIGHNexus Repository 3 - Script Execution Disable Setting Not EnforcedEPSS 0.7%CVE-2026-97666MEDIUMNexus Repository 3 - Unsafe Reflection in ExtDirect Repository EndpointEPSS 0.6%CVE-2026-14644HIGHNexus Repository 3 - Privilege EscalationEPSS 0.6%CVE-2026-17601HIGHNexus Repository 3 - Wildcard Privilege Update Self-Escalation to AdministratorEPSS 0.5%