CVE-2026-113370 · Package
NO FIX YET
Sonatype Nexus Repository 3 has a SQL injection flaw in an optional 'Reindex Search Tables By Pattern' task. A user who can create tasks can supply a crafted filter that the database runs as SQL, letting them modify data in the Nexus database.
first public Nov 4, 2026 · 2 sources
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only installations that turned on the non-default setting nexus.reindex.search.by.pattern.visible and have users with the nexus:tasks:create privilege can be exploited. Teams that keep the default configuration or restrict task creation to trusted administrators have a much smaller exposure. The sources do not list fixed versions.
Not affected if default-config, no-task-creators
Who cares java, nexus-repository, self-hosted
Unknown from the sources.
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.
This page as .md · .json · in your agent: get_signal("CVE-2026-113370") · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.