---
id: "CVE-2026-113374"
kind: "vulnerability"
aliases: ["CVE-2026-113374"]
title: "Sonatype Nexus Repository 3: user with only capability-create permission can enable Rut Auth header login and act as admin (fixed in 3.98.0)"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Nexus Repository 3", "fixed": ["3.98.0"], "affected": ">= 3.0.0, < 3.98.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "java", "nexus-repository", "self-hosted"]
not_affected_if: ["capabilities-privilege-admin-only", "nexus-3.98.0-or-later", "unknown"]
published_at: "2026-11-04T20:18:57+00:00"
first_seen_at: "2026-11-04T20:29:02+00:00"
updated_at: "2026-11-04T20:31:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113374", "first_seen_at": "2026-11-04T20:29:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T20:31:32+00:00"}]
---

# Sonatype Nexus Repository 3: user with only capability-create permission can enable Rut Auth header login and act as admin (fixed in 3.98.0)

Sonatype Nexus Repository 3 CE/Pro 3.0.0 to 3.97.x does not require realm administration permission when a Rut Auth capability is created. An account holding only nexus:capabilities:create can turn on header-based authentication, after which a remote client can authenticate as any existing user, including an administrator, without credentials. Fixed in 3.98.0; Sonatype is not aware of active exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nexus Repository 3 affected >= 3.0.0, < 3.98.0 fixed 3.98.0

## How to check

Check your Nexus Repository 3 version (CE/Pro 3.0.0 through 3.97.x is affected). In Settings > Capabilities look for a Rut Auth capability, and in Security > Realms for an active Rut Auth realm; if you do not use header authentication, either one is suspect. List which roles and users hold nx-capabilities-* / nexus:capabilities:create. Workaround if you cannot upgrade (Sonatype): grant nx-capabilities-* only to trusted administrators and remove it from all other accounts.

## Fix

Upgrade to Sonatype Nexus Repository 3 CE/Pro 3.98.0 or later. After upgrading, creating, updating or enabling a Rut Auth capability needs nexus:settings:update as well. Existing capabilities are not removed: delete any Rut Auth capability and remove the Rut Auth realm if you do not use them, and treat an unexpected one as a sign of compromise.

## Timeline

- 2026-11-04T20:29:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113374
- 2026-11-04T20:31:32+00:00 analyst — Read Sonatype advisory (linked from NVD) and 3.98.0 release notes: affected CE/Pro 3.0.0-3.97.x, fixed 3.98.0 (released 2026-11-03). Advisory says no known exploitation; no PoC found. Advisory does not say whether Rut Auth is on by default; it implies the attacker must create the capability. X not searched (credits depleted per notes).

## Documents

- [advisory] CVE-2026-113374 Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation https://support.sonatype.com/hc/en-us/articles/56616522124435/
- [fix] Sonatype Nexus Repository 3.98.0 Release Notes https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html

## From the sources

Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_