CVE-2026-113374: Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated user with the nexus:capabilities:create permission can exploit it. They do not need realm administration permission.
What does an attacker need to do to gain elevated access?
The attacker must create a Rut Auth capability, which enables header-based authentication for the Nexus Repository instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.
Are unauthenticated remote attackers able to trigger the vulnerable configuration directly?
The described capability creation requires the nexus:capabilities:create permission. However, once the Rut Auth capability has been created, a remote client can authenticate as an existing user without credentials.