CVE-2026-113371: Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.
Event History
Frequently Asked Questions
Which users can retrieve the signing passphrase?
Any account with only the read privilege for administering an affected APT or YUM repository can retrieve it. The account does not need permission to edit the repository.
What access does an attacker need to exploit this issue?
The attacker needs an authenticated user account with the repository administration read privilege for an APT or YUM repository. No repository edit privilege or user interaction is required.
What is exposed if the issue is exploited?
The repository signing passphrase is returned through an internal REST endpoint. The provided information does not state whether other repository types or credentials are affected.