{"id":"CVE-2026-113371","kind":"vulnerability","aliases":["CVE-2026-113371"],"related":[],"title":"Sonatype Nexus Repository 3: read-only user can retrieve APT/YUM signing passphrase","description":"Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.","summary":"Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository through an internal REST endpoint. A user holding only the read privilege for repository administration can obtain that passphrase, which lets them sign packages as the repository.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apt","package","self-hosted","sonatype-nexus","yum"],"not_affected_if":["no-signed-apt-or-yum-repos"],"how_to_check":"Affected range unknown. Check whether your Nexus Repository 3 instance hosts APT or YUM repositories with a signing key and passphrase configured, and which accounts (including anonymous, if enabled) hold the read privilege for repository administration. Compare your version with the Sonatype advisory once published.","fix":null,"status":"open","published_at":"2026-11-04T20:18:56+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","triaged_at":"2026-11-04T20:30:01+00:00","updated_at":"2026-11-04T20:32:49+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-04T20:30:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Sonatype Nexus Repository 3: read-only user can retrieve APT/YUM signing passphrase","impact":"high","summary":"Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository through an internal REST endpoint. A user holding only the read privilege for repository administration can obtain that passphrase, which lets them sign packages as the repository.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sonatype-nexus","apt","yum","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privileged user obtains signing key passphrase, enabling repository package forgery","analyst_note":"Find the affected and fixed Nexus 3 versions and the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-113371; sources here state neither.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-signed-apt-or-yum-repos"],"who_is_affected":"Teams running Sonatype Nexus Repository 3 that host APT or YUM repositories with signing enabled are exposed. Users with only the read privilege for repository administration can reach the passphrase; the sources do not say which Nexus versions are affected. Installations without signed APT or YUM repositories can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4111,"output_tokens":535,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Nexus 3 versions and the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-113371; sources here state neither.","search":"'-113371':16A,19A '-2026':15A,18A '3':4A,32B,73C 'account':92C,104C 'administ':100C 'administr':57B 'apt':20B,39B,80C 'apt/yum':11A 'cve':14A,17A 'edit':111C 'endpoint':47B,88C 'hold':50B,94C 'host':24B 'intern':45B,86C 'let':63B 'need':107C 'nexus':2A,27B,30B,71C 'obtain':59B 'packag':21B,66B 'passphras':13A,36B,61B,77C 'privileg':54B,98C,109C 'read':6A,53B,97C 'read-on':5A 'repositori':3A,31B,42B,56B,69B,72C,83C,102C,113C 'rest':46B,87C 'retriev':10A 'return':33B,74C 'self':23B 'self-host':22B 'sign':12A,35B,65B,76C 'sonatyp':1A,26B,29B,70C 'sonatype-nexus':25B 'user':8A,49B,91C 'yum':28B,41B,82C","nicknames":[],"mitigations":[],"who_affected":"Teams running Sonatype Nexus Repository 3 that host APT or YUM repositories with signing enabled are exposed. Users with only the read privilege for repository administration can reach the passphrase; the sources do not say which Nexus versions are affected. Installations without signed APT or YUM repositories can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apt","high","package","selfhosted","sonatypenexus","yum"],"campaign_type":null,"first_public_at":"2026-11-04T20:18:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"103e4ec9-0a87-450b-af77-479448ddef11","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113371","severity":null,"published_at":"2026-11-04T20:18:56+00:00","modified_at":"2026-11-04T20:18:56+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","fetched_at":"2026-11-04T20:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113371:1703","url":null,"severity":null,"published_at":"2026-11-04T20:32:49+00:00","modified_at":"2026-11-04T20:32:49+00:00","first_seen_at":"2026-11-04T20:32:49+00:00","fetched_at":"2026-11-04T20:32:49+00:00","note":"No Sonatype advisory yet: support.sonatype.com advisories index (checked 2026-11-04) lists nothing for this CVE; NVD page has no version data. Affected/fixed versions unknown; recheck the index in a day or two. Nothing verified. Sibling CVE-2026-113372 (YUM key) same state."}],"documents":[{"id":70327,"url":"https://support.sonatype.com/hc/en-us/sections/203012668-Security-Advisories","title":"Sonatype Security Advisories index (checked 2026-11-04; no entry for CVE-2026-113370 yet)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":70334,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113371","title":"NVD CVE-2026-113371 (no version data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}