Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-5189

Nexus Repository 3 - Hardcoded Credential in Internal Database Component

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Sonatype

Description

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Sonatype Nexus Repository

Default version status: unaffected

  • 3.0.0 to < 3.71.0affected

References