CVE-2026-113371 · Package
NO FIX YET
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository through an internal REST endpoint. A user holding only the read privilege for repository administration can obtain that passphrase, which lets them sign packages as the repository.
first public Nov 4, 2026 · 2 sources
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams running Sonatype Nexus Repository 3 that host APT or YUM repositories with signing enabled are exposed. Users with only the read privilege for repository administration can reach the passphrase; the sources do not say which Nexus versions are affected. Installations without signed APT or YUM repositories can skip it.
Not affected if no-signed-apt-or-yum-repos
Who cares apt, self-hosted, sonatype-nexus, yum
Unknown from the sources.
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.
This page as .md · .json · in your agent: get_signal("CVE-2026-113371") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.