Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task
Affects Sonatype Nexus Repository 3 CE/Pro versions 3.90.0 through 3.97.x when the reindex search-by-pattern task is visible. CVSS scores it high; no vendor rating is given. Fixed in 3.98.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 3.98.0
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. The task is available only when the setting nexus.reindex.search.by.pattern.visible is set to true. The user must hold the nexus:tasks:create privilege. Affected: Sonatype Nexus Repository 3 CE/Pro versions from 3.90.0 up to and including 3.97.x.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity7.7/10CVSS 7.7
- No patch0/5No signal
What would change the score
- Would score about 66 if added to CISA KEV
- Would score about 61 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
CVE-2026-113370 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.7 (high) and affects Nexus Repository 3; fixed in 3.98.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 16/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 3.98.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Sonatype Nexus Repository 3 contains a SQL injection flaw in its optional "Reindex Search Tables By Pattern" task. An attacker with low-privilege login (one holding the task-create permission) can reach it over the network, and can use it to modify data in the Nexus database. The flaw is only reachable when the non-default setting nexus.reindex.search.by.pattern.visible is enabled, so it requires a non-default setup.
Read the original description
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.
What to do
Check whether your setup matches what the bug needs.
The task is available only when the setting nexus.reindex.search.by.pattern.visible is set to true. The user must hold the nexus:tasks:create privilege. Affected: Sonatype Nexus Repository 3 CE/Pro versions from 3.90.0 up to and including 3.97.x.Upgrade to a fixed version: 3.98.0.
Workaround: Make sure the setting nexus.reindex.search.by.pattern.visible is not set to true, so the task cannot be created.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Sonatype Nexus Repository 3
From 3.90.0 · fixed in 3.98.0
Evidence 2
- Advisory
- Patch
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-113370
Is CVE-2026-113370 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The reindex search-by-pattern task builds a database query from user input without properly neutralizing it, so a user who can create the task can alter data in the Nexus database, including scheduled task definitions.Source: support.sonatype.com
Which versions are affected by CVE-2026-113370?
Nexus Repository 3: from 3.90.0 before 3.98.0.Source: cve.now feed data
Am I affected, and how do I check?
Versions from 3.90.0 up to and including 3.97.x of Sonatype Nexus Repository 3 CE/Pro are in scope. The task only appears when the setting nexus.reindex.search.by.pattern.visible is set to true, and the user must hold the nexus:tasks:create privilege. Check the version under the product's About page and the value of that setting in the configuration.Source: support.sonatype.com
How do I fix CVE-2026-113370?
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.98.0, which contains the fix. Until then, make sure nexus.reindex.search.by.pattern.visible is not set to true so the task cannot be created.Source: support.sonatype.com