{"id":"CVE-2026-113374","kind":"vulnerability","aliases":["CVE-2026-113374"],"related":[],"title":"Sonatype Nexus Repository 3: user with only capability-create permission can enable Rut Auth header login and act as admin (fixed in 3.98.0)","description":"Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.","summary":"Sonatype Nexus Repository 3 CE/Pro 3.0.0 to 3.97.x does not require realm administration permission when a Rut Auth capability is created. An account holding only nexus:capabilities:create can turn on header-based authentication, after which a remote client can authenticate as any existing user, including an administrator, without credentials. Fixed in 3.98.0; Sonatype is not aware of active exploitation.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nexus Repository 3","fixed":["3.98.0"],"affected":">= 3.0.0, < 3.98.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","java","nexus-repository","self-hosted"],"not_affected_if":["capabilities-privilege-admin-only","nexus-3.98.0-or-later","unknown"],"how_to_check":"Check your Nexus Repository 3 version (CE/Pro 3.0.0 through 3.97.x is affected). In Settings > Capabilities look for a Rut Auth capability, and in Security > Realms for an active Rut Auth realm; if you do not use header authentication, either one is suspect. List which roles and users hold nx-capabilities-* / nexus:capabilities:create. Workaround if you cannot upgrade (Sonatype): grant nx-capabilities-* only to trusted administrators and remove it from all other accounts.","fix":"Upgrade to Sonatype Nexus Repository 3 CE/Pro 3.98.0 or later. After upgrading, creating, updating or enabling a Rut Auth capability needs nexus:settings:update as well. Existing capabilities are not removed: delete any Rut Auth capability and remove the Rut Auth realm if you do not use them, and treat an unexpected one as a sign of compromise.","status":"open","published_at":"2026-11-04T20:18:57+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","triaged_at":"2026-11-04T20:29:54+00:00","updated_at":"2026-11-04T20:31:32+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-04T20:29:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Sonatype Nexus Repository 3: low-privilege user can enable header authentication and log in as admin","impact":"high","summary":"Sonatype Nexus Repository 3 does not check for realm administration permission when a user creates a Rut Auth capability, so a user holding only the capability creation permission can turn on header-based authentication. A remote client can then authenticate as any existing user, including an administrator, without credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["nexus-repository","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"remote attacker logs in as administrator without credentials","analyst_note":"Find the affected and fixed Nexus Repository 3 version ranges and the Sonatype advisory from the NVD entry; confirm whether the header authentication capability is on by default.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Any Nexus Repository 3 instance where some user holds the nexus:capabilities:create permission can be exposed, since that is the only privilege needed to enable the flaw. Instances reachable from the network are the main concern. The sources do not state which versions are affected or whether the header authentication feature must already be configured.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":4137,"output_tokens":508,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Nexus Repository 3 version ranges and the Sonatype advisory from the NVD entry; confirm whether the header authentication capability is on by default.","search":"'-113374':27A,30A '-2026':26A,29A '3':4A,33A,45B,107C '3.0.0':47B '3.97':49B '3.98.0':24A,96B 'account':65B 'act':19A 'activ':102B 'admin':21A 'administr':55B,91B,112C,160C 'auth':15A,60B,120C 'authent':77B,84B,144C,153C 'awar':100B 'base':76B,143C 'capability-cr':8A 'capabl':9A,61B,69B,121C,128C,132C,137C 'ce/pro':46B 'client':82B,150C 'creat':10A,63B,70B,117C,133C,135C 'creation':129C 'credenti':93B,162C 'cve':25A,28A 'enabl':13A 'exist':87B,156C 'exploit':103B 'fix':22A,94B 'header':16A,75B,142C 'header-bas':74B,141C 'hold':66B,125C 'host':41B 'includ':89B,158C 'infrastructur':34B 'instanc':147C 'java':35B 'login':17A 'nexus':2A,31A,37B,43B,68B,105C,131C 'nexus-repositori':36B 'permiss':11A,56B,113C,130C 'realm':54B,111C 'remot':81B,149C 'repositori':3A,38B,44B,106C 'repository':32A 'requir':53B,110C 'rut':14A,59B,119C 'self':40B 'self-host':39B 'sonatyp':1A,42B,97B,104C 'turn':72B,139C 'user':5A,88B,116C,123C,157C 'without':92B,161C 'x':50B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Nexus Repository 3 CE or Pro, versions 3.0.0 through 3.97.x, where some non-admin account holds the nexus:capabilities:create permission (for example nx-capabilities-create) and the instance is reachable over the network. Once the Rut Auth capability exists, the attacker needs no account. Instances where capability privileges are held only by administrators, or that run 3.98.0 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T20:31:32Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1701},"products":{"at":"2026-11-04T20:31:32Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1701},"how_to_check":{"at":"2026-11-04T20:31:32Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1701},"who_affected":{"at":"2026-11-04T20:31:32Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1701}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nexusrepository3","repository3"],"ptokens":["nexus","repository"],"labels":["high","infrastructure","java","nexusrepository","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T20:18:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"103e4ec9-0a87-450b-af77-479448ddef11","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113374","severity":null,"published_at":"2026-11-04T20:18:57+00:00","modified_at":"2026-11-04T20:18:57+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","fetched_at":"2026-11-04T20:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113374:1701","url":null,"severity":null,"published_at":"2026-11-04T20:31:32+00:00","modified_at":"2026-11-04T20:31:32+00:00","first_seen_at":"2026-11-04T20:31:32+00:00","fetched_at":"2026-11-04T20:31:32+00:00","note":"Read Sonatype advisory (linked from NVD) and 3.98.0 release notes: affected CE/Pro 3.0.0-3.97.x, fixed 3.98.0 (released 2026-11-03). Advisory says no known exploitation; no PoC found. Advisory does not say whether Rut Auth is on by default; it implies the attacker must create the capability. X not searched (credits depleted per notes)."}],"documents":[{"id":70330,"url":"https://support.sonatype.com/hc/en-us/articles/56616522124435/","title":"CVE-2026-113374 Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":70329,"url":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","title":"Sonatype Nexus Repository 3.98.0 Release Notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}