Sonatype vulnerabilities
We track 25 vulnerabilities in Sonatype products across 4 products. 25 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on November 4, 2026.
Latest Sonatype vulnerabilities
- 8.6 High severity
Nexus Repository 3: Missing Authorization
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based
- 8.1 High severity
Nexus Repository 3: Weak Authentication
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in a
- 7.1 High severity
Nexus Repository 3: Insufficiently Protected Credentials
Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that hold
- 7.1 High severity
Nexus Repository 3: Insufficiently Protected Credentials
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit t
- 7.7 High severity
Nexus Repository 3: Improper Neutralization of Special Elements used in an SQL Command
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the u
- 8.7 High severity
Nexus Repository 3: Missing Authorization
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
- 7.1 High severity
Nexus Repository 3: Missing Authorization
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permis
- 7.1 High severity
Nexus Repository 3: Incorrect Authorization
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these e
- 7.2 High severity
Nexus Repository 3: Incomplete List of Disallowed Inputs
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run
- 8.8 High severity
Nexus Repository 3: Improper Control of Generation of Code
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQ
- 7.2 High severity
Nexus Repository 3: Missing Authorization
A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional author
- 8.8 High severity
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or…
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of
- 7.2 High severity
Nexus Repository 3: Unverified Password Change
Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a l
- 7.2 High severity
Nexus Repository: Use of Externally-Controlled Input to Select Classes or Code
An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not v
- 7.2 High severity
Nexus Repository 3: Access of Resource Using Incompatible Type
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a t
- 7.7 High severity
Nexus Repository 3: Server-Side Request Forgery
Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised
- 7.5 High severity
Nexus Repository Manager: Insufficient Entropy
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token,
- 7.2 High severity
Nexus Repository: Deserialization of Untrusted Data
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.
- 7.5 High severity
Nexus Repository Manager: Improper Restriction of Excessive Authentication Attempts
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.
- 9.8 Critical severity
Nexus Repository: Use of Hard-coded Credentials
CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands a
- 8.8 High severity
Nexus Repository: Deserialization of Untrusted Data
A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.
- 8.7 High severity
Nexus Repository: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.
- 7.1 High severity
Nexus Repository: Improper Control of Generation of Code
A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
- 8.8 High severity
Sonatype Nexus Repository Remote Code Execution Exploited
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
- 9.8 Critical severity
Sonatype Nexus Repository Manager Incorrect Access Control Exploited
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.