CVE-2026-5189
Hardcoded Credentials in Nexus Repository Enable Remote Code Execution
Publication date: 2026-04-15
Last updated on: 2026-04-15
Assigner: Sonatype
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sonatype | nexus_repository | From 3.0.0 (inc) to 3.70.5 (inc) |
| sonatype | nexus_repository_manager | From 3.0.0 (inc) to 3.70.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an unauthenticated attacker to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. This unauthorized access and potential data manipulation could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls over access to sensitive data and systems.
Specifically, the use of hard-coded credentials and the resulting unauthorized access could compromise the confidentiality, integrity, and availability of data managed by the Nexus Repository Manager, thereby impacting compliance with standards that mandate protection of personal and sensitive information.
Can you explain this vulnerability to me?
This vulnerability, identified as CWE-798, involves the use of hard-coded credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5.
An unauthenticated attacker with network access can exploit this issue if the non-default configuration nexus.orient.binaryListenerEnabled=true is enabled.
Exploitation allows the attacker to gain unauthorized read and write access to the internal database and execute arbitrary operating system commands as the Nexus process user.
How can this vulnerability impact me? :
The vulnerability can have severe impacts including unauthorized access to sensitive data stored in the internal database of the Nexus Repository Manager.
An attacker can modify or delete data, potentially disrupting development workflows or corrupting repository contents.
Additionally, the attacker can execute arbitrary OS commands with the privileges of the Nexus process user, which could lead to further system compromise or lateral movement within the network.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 when the non-default configuration nexus.orient.binaryListenerEnabled=true is enabled.
Immediate mitigation steps include upgrading to Sonatype Nexus Repository Manager version 3.71.0 or later, where this issue is addressed.
Alternatively, if upgrading is not immediately possible, ensure that the configuration nexus.orient.binaryListenerEnabled is set to false (the default) to prevent exploitation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the use of hard-coded credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5, and exploitation requires the non-default configuration nexus.orient.binaryListenerEnabled=true to be enabled.
To detect this vulnerability on your system, you should first verify if you are running a vulnerable version of Sonatype Nexus Repository Manager (between 3.0.0 and 3.70.5).
Next, check if the configuration setting nexus.orient.binaryListenerEnabled is set to true, as exploitation requires this setting enabled.
- Check Nexus Repository Manager version by running: `nexus --version` or checking the application UI or logs.
- Check the configuration file (usually nexus.properties or similar) for the setting: `grep 'nexus.orient.binaryListenerEnabled' /path/to/nexus/etc/nexus.properties`
- If the output shows `nexus.orient.binaryListenerEnabled=true`, the system is potentially vulnerable.
Additionally, monitor network traffic for unauthorized access attempts or unusual commands executed by the Nexus process user, but specific detection commands for network scanning or intrusion detection are not provided in the available resources.