{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-113371","assignerOrgId":"103e4ec9-0a87-450b-af77-479448ddef11","state":"PUBLISHED","assignerShortName":"Sonatype","dateReserved":"2026-10-20T01:54:48.996Z","datePublished":"2026-11-04T20:01:20.078Z","dateUpdated":"2026-11-04T20:01:20.078Z"},"containers":{"cna":{"providerMetadata":{"orgId":"103e4ec9-0a87-450b-af77-479448ddef11","shortName":"Sonatype","dateUpdated":"2026-11-04T20:01:20.078Z"},"title":"Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-522","description":"CWE-522 Insufficiently Protected Credentials","type":"CWE"}]}],"affected":[{"vendor":"Sonatype","product":"Nexus Repository 3","versions":[{"status":"affected","version":"3.93.0","lessThan":"3.98.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":["cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*"]}],"descriptions":[{"lang":"en","value":"Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.</p>"}]}],"references":[{"url":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","tags":["patch"]},{"url":"https://support.sonatype.com/hc/en-us/articles/56609541356051/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}],"credits":[{"lang":"en","value":"Ho Boon Suan","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}}}}