CVE-2026-113370: Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.
Event History
Frequently Asked Questions
Which deployments are exposed?
Only Nexus Repository 3 deployments where the non-default nexus.reindex.search.by.pattern.visible setting is set to true are exposed through this task. The affected task is otherwise unavailable.
What access does an attacker need?
An attacker must already hold the nexus:tasks:create privilege and be able to provide a crafted filter condition to the Reindex Search Tables By Pattern task. No user interaction is required.
What can a successful exploit do?
The crafted filter condition is executed by the database as SQL, allowing the privileged user to modify data in the Nexus database.
How can I reduce exposure if I cannot patch immediately?
Ensure nexus.reindex.search.by.pattern.visible is not set to true, which prevents the optional task from being available. Also restrict the nexus:tasks:create privilege to trusted users.