Sonatype Nexus Repository 3 YUM Repository Private Key Exposure

Executive Summary

CVE-2026-113372 is a vulnerability in Sonatype Nexus Repository 3 where the private signing key of a YUM proxy or group repository is exposed to accounts with only read privileges for administering that repository. This occurs even though the account lacks edit privileges, and the repository uses the key to sign its metadata.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if any accounts with only read privileges for YUM proxy or group repositories have access to private signing keys. Review Nexus Repository role assignments and repository configurations for exposed keys. Use Nexus Repository logs to identify unauthorized access attempts to signing keys.

Useful 0 Not Useful 0

Impact Analysis

An attacker with read access to the repository could obtain the private signing key and use it to sign malicious repository metadata. This could allow the attacker to distribute compromised packages to users of the repository, leading to potential code execution or data breaches on systems that trust the repository.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance penalties if the exposure results in a data breach.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade to Sonatype Nexus Repository 3.98.0 or later to patch the vulnerability.
• Restrict repository administration read privileges to fully trusted accounts only.
• Rotate any exposed private signing keys and update client trust configurations.
• Limit network access to the Nexus Repository web interface and REST API.
• Review and audit role and group mappings for unnecessary privileges.

Useful 0 Not Useful 0