CVE-2026-113372: Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key
Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Nexus Repository 3 deployments with YUM proxy or group repositories that use repository signing keys are exposed if an account has read privilege for administering one of those repositories. The affected account does not need permission to edit the repository.
What access does an attacker need to exploit it?
An attacker needs an authenticated Nexus account with only the read privilege for administering the affected YUM proxy or group repository. They can obtain the repository's private signing key without repository edit privileges.
What could an attacker do with the exposed key?
A party holding the private signing key can sign repository metadata as the affected repository. This can make metadata signed by the attacker appear to originate from that repository.