Sonatype Nexus Repository Manager vulnerabilities
4 known CVE vulnerabilities in Sonatype Nexus Repository Manager, translated and rated.
- CVE-2026-5189Critical
Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 contain hard-coded credentials (CWE-798), allowing an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration.
- CVE-2017-17717Critical
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature.
- CVE-2026-11403High
A vulnerability in Sonatype Nexus Repository Manager allows a remote attacker to gain unauthorized access to repository operations as a targeted user. Exploitation requires enabling a format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) and the targeted user having an active API key.
- CVE-2026-10741Medium
Vulnerability in Sonatype Nexus Repository Manager before version 3.93.0 allows a delegated repository administrator to disclose stored upstream proxy credentials via an authorization flaw in proxy repository configuration.