How do I check whether I am affected by CVE-2026-113374?

Check your Nexus Repository 3 version (CE/Pro 3.0.0 through 3.97.x is affected). In Settings > Capabilities look for a Rut Auth capability, and in Security > Realms for an active Rut Auth realm; if you do not use header authentication, either one is suspect. List which roles and users hold nx-capabilities-* / nexus:capabilities:create. Workaround if you cannot upgrade (Sonatype): grant nx-capabilities-* only to trusted administrators and remove it from all other accounts.

What is the fix for CVE-2026-113374?

Upgrade to Sonatype Nexus Repository 3 CE/Pro 3.98.0 or later. After upgrading, creating, updating or enabling a Rut Auth capability needs nexus:settings:update as well. Existing capabilities are not removed: delete any Rut Auth capability and remove the Rut Auth realm if you do not use them, and treat an unexpected one as a sign of compromise.

Post Share

HIGH8.6CVSS · 103e4ec9-0a87-450b-af77-479448ddef11

NO KNOWN
EXPLOIT

NEXUS REPOSITORY 3 · CVE-2026-113374 · Infrastructure

Sonatype Nexus Repository 3: user with only capability-create permission can enable Rut Auth header login and act as admin (fixed in 3.98.0)

Q: Who is not affected by CVE-2026-113374?

Not affected if: capabilities-privilege-admin-only, nexus-3.98.0-or-later, unknown.

FIX → 3.98.0 ✓ verified

Sonatype Nexus Repository 3 CE/Pro 3.0.0 to 3.97.x does not require realm administration permission when a Rut Auth capability is created. An account holding only nexus:capabilities:create can turn on header-based authentication, after which a remote client can authenticate as any existing user, including an administrator, without credentials. Fixed in 3.98.0; Sonatype is not aware of active exploitation.

Full story ↓Less ↑

first public Nov 4, 2026 · 2 sources

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

01 · Who is affected

✓ Verified Nov 4

Self-hosted Nexus Repository 3 CE or Pro, versions 3.0.0 through 3.97.x, where some non-admin account holds the nexus:capabilities:create permission (for example nx-capabilities-create) and the instance is reachable over the network. Once the Rut Auth capability exists, the attacker needs no account. Instances where capability privileges are held only by administrators, or that run 3.98.0 or later, can skip it.

Nexus Repository 3>= 3.0.0, < 3.98.0fixed in 3.98.0

Not affected if capabilities-privilege-admin-only, nexus-3.98.0-or-later, unknown

Who cares java, nexus-repository, self-hosted

02 · How to check

✓ Verified Nov 4

Check your Nexus Repository 3 version (CE/Pro 3.0.0 through 3.97.x is affected)
In Settings > Capabilities look for a Rut Auth capability, and in Security > Realms for an active Rut Auth realm; if you do not use header authentication, either one is suspect
List which roles and users hold nx-capabilities-* / nexus:capabilities:create
Workaround if you cannot upgrade (Sonatype): grant nx-capabilities-* only to trusted administrators and remove it from all other accounts

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 4, 2026

How it unfolded

2 events · Nov 4, 2026 → Nov 4, 2026

Nov 4, 202620:29 UTCNVD CVE-2026-113374
Nov 4, 202620:31 UTCInfraStack Analyst Read Sonatype advisory (linked from NVD) and 3.98.0 release notes: affected CE/Pro 3.0.0-3.97.x, fixed 3.98.0 (released 2026-11-03). Advisory says no known exploitation; no PoC found. Advisory does not say whether Rut Auth is on by default; it implies the attacker must create the capability. X not searched (credits depleted per notes).moreless

What the sources say, verbatim

401 characters

Get the next Nexus Repository 3 threat the day it hits your stack.

Start watching free

Post Share

HIGH8.6CVSS · 103e4ec9-0a87-450b-af77-479448ddef11

NO KNOWN
EXPLOIT

NEXUS REPOSITORY 3 · CVE-2026-113374 · Infrastructure

Sonatype Nexus Repository 3: user with only capability-create permission can enable Rut Auth header login and act as admin (fixed in 3.98.0)

FIX → 3.98.0 ✓ verified

Full story ↓Less ↑

first public Nov 4, 2026 · 2 sources

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

01 · Who is affected

✓ Verified Nov 4

Nexus Repository 3>= 3.0.0, < 3.98.0fixed in 3.98.0

Not affected if capabilities-privilege-admin-only, nexus-3.98.0-or-later, unknown

Who cares java, nexus-repository, self-hosted

02 · How to check

✓ Verified Nov 4

Check your Nexus Repository 3 version (CE/Pro 3.0.0 through 3.97.x is affected)
In Settings > Capabilities look for a Rut Auth capability, and in Security > Realms for an active Rut Auth realm; if you do not use header authentication, either one is suspect
List which roles and users hold nx-capabilities-* / nexus:capabilities:create
Workaround if you cannot upgrade (Sonatype): grant nx-capabilities-* only to trusted administrators and remove it from all other accounts

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 4, 2026

How it unfolded

2 events · Nov 4, 2026 → Nov 4, 2026

Nov 4, 202620:29 UTCNVD CVE-2026-113374
Nov 4, 202620:31 UTCInfraStack Analyst Read Sonatype advisory (linked from NVD) and 3.98.0 release notes: affected CE/Pro 3.0.0-3.97.x, fixed 3.98.0 (released 2026-11-03). Advisory says no known exploitation; no PoC found. Advisory does not say whether Rut Auth is on by default; it implies the attacker must create the capability. X not searched (credits depleted per notes).moreless

What the sources say, verbatim

401 characters

Get the next Nexus Repository 3 threat the day it hits your stack.

Start watching free

Sonatype Nexus Repository 3: user with only capability-create permission can enable Rut Auth header login and act as admin (fixed in 3.98.0)

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Read next

Get the next Nexus Repository 3 threat the day it hits your stack.

Sonatype Nexus Repository 3: user with only capability-create permission can enable Rut Auth header login and act as admin (fixed in 3.98.0)

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Read next

Get the next Nexus Repository 3 threat the day it hits your stack.

03 · The fix

Sources and references