CVE-2026-113372
Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.
| CWE | CWE-522 |
| Vendor | sonatype |
| Product | nexus repository 3 |
| Published | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for sonatype nexus repository 3
Be the first to know when new unknown vulnerabilities affecting sonatype nexus repository 3 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Sonatype / Nexus Repository 3
3.93.0 < 3.98.0