{"id":"CVE-2026-113372","kind":"vulnerability","aliases":["CVE-2026-113372"],"related":[],"title":"Sonatype Nexus Repository 3: read-only account can extract YUM repository signing key","description":"Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.","summary":"Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to any account holding only the read privilege for that repository, per the NVD-derived description. A holder of that key can sign repository metadata as that repository. No Sonatype advisory with affected or fixed versions was found yet.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nexus-repository","package","self-hosted","yum"],"not_affected_if":["no-yum-repositories"],"how_to_check":"Unknown affected range. Check whether your Nexus Repository 3 instance has YUM proxy or group repositories with a GPG signing key configured, and which accounts (including anonymous, if enabled) hold read on them. Compare your version against the Sonatype advisory once published.","fix":null,"status":"open","published_at":"2026-11-04T20:18:56+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","triaged_at":"2026-11-04T20:29:59+00:00","updated_at":"2026-11-04T20:31:06+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-04T20:29:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Sonatype Nexus Repository 3: read-only account can extract YUM repository signing key","impact":"medium","summary":"Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to any account holding only the read privilege for that repository. A holder of that key can sign repository metadata as if it came from the repository.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nexus-repository","yum","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"read-only account can obtain repository signing key and forge metadata","analyst_note":"Find the affected and fixed Nexus Repository 3 versions and the vendor advisory at the NVD entry or Sonatype security page.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-yum-repositories"],"who_is_affected":"Teams that run a self-hosted Sonatype Nexus Repository 3 instance and serve YUM proxy or group repositories are exposed. The sources do not state the affected version range or whether a non-default setting is required. Teams not running Nexus 3 with YUM repositories can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":4115,"output_tokens":475,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Nexus Repository 3 versions and the vendor advisory at the NVD entry or Sonatype security page.","search":"'-113372':17A,20A '-2026':16A,19A '3':4A,32B,88C 'account':8A,47B,103C,115C 'administ':111C 'advisori':76B 'affect':78B 'cve':15A,18A 'deriv':60B 'descript':61B 'edit':122C 'extract':10A 'fix':80B 'found':83B 'group':43B,99C 'hold':48B,105C,128C 'holder':63B 'host':27B 'key':14A,37B,66B,93C,130C 'metadata':70B,134C 'need':118C 'nexus':2A,22B,30B,86C 'nexus-repositori':21B 'nvd':59B 'nvd-deriv':58B 'packag':24B 'parti':126C 'per':56B 'privat':35B,91C 'privileg':52B,109C,120C 'proxi':41B,97C 'read':6A,51B,108C 'read-on':5A 'repositori':3A,12A,23B,31B,44B,55B,69B,73B,87C,100C,113C,124C,133C,137C 'return':33B,89C 'self':26B 'self-host':25B 'sign':13A,36B,68B,92C,132C 'sonatyp':1A,29B,75B,85C 'version':81B 'yet':84B 'yum':11A,28B,40B,96C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Sonatype Nexus Repository 3 instance and serve YUM proxy or group repositories are exposed. The sources do not state the affected version range or whether a non-default setting is required. Teams not running Nexus 3 with YUM repositories can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nexusrepository","package","selfhosted","yum"],"campaign_type":null,"first_public_at":"2026-11-04T20:18:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"103e4ec9-0a87-450b-af77-479448ddef11","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113372","severity":null,"published_at":"2026-11-04T20:18:56+00:00","modified_at":"2026-11-04T20:18:56+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","fetched_at":"2026-11-04T20:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113372:1702","url":null,"severity":null,"published_at":"2026-11-04T20:31:06+00:00","modified_at":"2026-11-04T20:31:06+00:00","first_seen_at":"2026-11-04T20:31:06+00:00","fetched_at":"2026-11-04T20:31:06+00:00","note":"No Sonatype advisory yet: support.sonatype.com index (checked 2026-11-04) and Sonatype Guide have no entry; NVD page returned no description or version data. Affected/fixed versions unknown. Recheck the Sonatype advisories index in a day or two; Sonatype advisories list 'Affected Versions' and 'Fixed in Version' (recent ones fixed in 3.96.0+, but that is not confirmed for this CVE). Nothing verified."}],"documents":[{"id":70326,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113372","title":"NVD CVE-2026-113372 (page has no description text)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":70327,"url":"https://support.sonatype.com/hc/en-us/sections/203012668-Security-Advisories","title":"Sonatype Security Advisories index (checked 2026-11-04; no entry for CVE-2026-113370 yet)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}