{"id":"CVE-2026-113370","kind":"vulnerability","aliases":["CVE-2026-113370"],"related":[],"title":"Sonatype Nexus Repository 3: SQL injection lets a task user change database data","description":"Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional \"Reindex Search Tables By Pattern\" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.","summary":"Sonatype Nexus Repository 3 has a SQL injection flaw in an optional 'Reindex Search Tables By Pattern' task. A user who can create tasks can supply a crafted filter that the database runs as SQL, letting them modify data in the Nexus database.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","nexus-repository","package","self-hosted"],"not_affected_if":["default-config","no-task-creators"],"how_to_check":"- Check whether nexus.reindex.search.by.pattern.visible is set to true (nexus.properties / system properties); the task exists only then and the setting is non-default. If unset or false, skip this.\n- List who holds the nexus:tasks:create privilege (Security > Privileges / Roles); only they can reach the flaw.\n- Affected and fixed versions are not yet published: NVD page has no readable version data and the Sonatype advisories index has no entry for this CVE as of 2026-11-04. Recheck the index for the fixed release.","fix":null,"status":"open","published_at":"2026-11-04T20:18:56+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","triaged_at":"2026-11-04T20:29:58+00:00","updated_at":"2026-11-04T20:33:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-04T20:29:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Sonatype Nexus Repository 3: SQL injection lets a task user change database data","impact":"high","summary":"Sonatype Nexus Repository 3 has a SQL injection flaw in an optional 'Reindex Search Tables By Pattern' task. A user who can create tasks can supply a crafted filter that the database runs as SQL, letting them modify data in the Nexus database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nexus-repository","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user modifies data in the Nexus database","analyst_note":"Sources list only NVD; check the Sonatype advisory for affected and fixed versions and any workaround.","how_to_check":"- Check whether the setting `nexus.reindex.search.by.pattern.visible` is set to `true`; the task is only available when it is.\n- Check which users hold the `nexus:tasks:create` privilege.\n- Confirm your Nexus Repository 3 version against the affected ranges in the NVD entry.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","no-task-creators"],"who_is_affected":"Only installations that turned on the non-default setting nexus.reindex.search.by.pattern.visible and have users with the nexus:tasks:create privilege can be exploited. Teams that keep the default configuration or restrict task creation to trusted administrators have a much smaller exposure. The sources do not list fixed versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4172,"output_tokens":583,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources list only NVD; check the Sonatype advisory for affected and fixed versions and any workaround.","search":"'-113370':16A,19A '-2026':15A,18A '3':4A,31B,74C 'allow':111C 'avail':124C 'chang':11A 'condit':103C 'contain':75C 'craft':55B,101C 'creat':50B,96C 'cve':14A,17A 'data':13A,66B,116C 'databas':12A,59B,70B,106C,120C 'default':130C 'filter':56B,102C 'flaw':36B 'hold':92C 'host':27B 'inject':6A,35B,78C 'java':20B 'let':7A,63B 'modifi':65B,115C 'nexus':2A,22B,29B,69B,72C,94C,119C 'nexus-repositori':21B 'nexus.reindex.search.by.pattern.visible':132C 'non':129C 'non-default':128C 'option':39B,82C 'packag':24B 'pattern':44B,87C 'privileg':97C 'reindex':40B,83C 'repositori':3A,23B,30B,73C 'run':60B,107C 'search':41B,84C 'self':26B 'self-host':25B 'set':131C,134C 'sonatyp':1A,28B,71C 'sql':5A,34B,62B,77C,109C 'suppli':53B,99C 'tabl':42B,85C 'task':9A,45B,51B,88C,95C,122C 'true':136C 'user':10A,47B,90C,113C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Only installations that turned on the non-default setting nexus.reindex.search.by.pattern.visible and have users with the nexus:tasks:create privilege can be exploited. Teams that keep the default configuration or restrict task creation to trusted administrators have a much smaller exposure. The sources do not list fixed versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","nexusrepository","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T20:18:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"103e4ec9-0a87-450b-af77-479448ddef11","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113370","severity":null,"published_at":"2026-11-04T20:18:56+00:00","modified_at":"2026-11-04T20:18:56+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","fetched_at":"2026-11-04T20:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113370:1704","url":null,"severity":null,"published_at":"2026-11-04T20:33:05+00:00","modified_at":"2026-11-04T20:33:05+00:00","first_seen_at":"2026-11-04T20:33:05+00:00","fetched_at":"2026-11-04T20:33:05+00:00","note":"No Sonatype advisory yet (index checked 2026-11-04, latest entries 2026-10-15); NVD page returned no body. Fix and versions unknown; nothing verified. Revisit when Sonatype publishes. X not queried."}],"documents":[{"id":70327,"url":"https://support.sonatype.com/hc/en-us/sections/203012668-Security-Advisories","title":"Sonatype Security Advisories index (checked 2026-11-04; no entry for CVE-2026-113370 yet)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}