---
id: "CVE-2026-113370"
kind: "vulnerability"
aliases: ["CVE-2026-113370"]
title: "Sonatype Nexus Repository 3: SQL injection lets a task user change database data"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "nexus-repository", "package", "self-hosted"]
not_affected_if: ["default-config", "no-task-creators"]
published_at: "2026-11-04T20:18:56+00:00"
first_seen_at: "2026-11-04T20:29:02+00:00"
updated_at: "2026-11-04T20:33:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113370", "first_seen_at": "2026-11-04T20:29:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T20:33:05+00:00"}]
---

# Sonatype Nexus Repository 3: SQL injection lets a task user change database data

Sonatype Nexus Repository 3 has a SQL injection flaw in an optional 'Reindex Search Tables By Pattern' task. A user who can create tasks can supply a crafted filter that the database runs as SQL, letting them modify data in the Nexus database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether nexus.reindex.search.by.pattern.visible is set to true (nexus.properties / system properties); the task exists only then and the setting is non-default. If unset or false, skip this.
- List who holds the nexus:tasks:create privilege (Security > Privileges / Roles); only they can reach the flaw.
- Affected and fixed versions are not yet published: NVD page has no readable version data and the Sonatype advisories index has no entry for this CVE as of 2026-11-04. Recheck the index for the fixed release.

## Timeline

- 2026-11-04T20:29:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113370
- 2026-11-04T20:33:05+00:00 analyst — No Sonatype advisory yet (index checked 2026-11-04, latest entries 2026-10-15); NVD page returned no body. Fix and versions unknown; nothing verified. Revisit when Sonatype publishes. X not queried.

## Documents

- [mentions] Sonatype Security Advisories index (checked 2026-11-04; no entry for CVE-2026-113370 yet) https://support.sonatype.com/hc/en-us/sections/203012668-Security-Advisories

## From the sources

Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_