---
id: CVE-2026-113372
title: >-
  Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository
  Signing Key
summary: >-
  Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or
  group repository to an account that holds only the read privilege for
  administering that repository. The account does not need the privilege to edit
  the reposi…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-522
vendor: Sonatype
product: Nexus Repository 3
affected:
  - nexus_repository_3 >= 3.93.0 < 3.98.0
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T20:01:19.849Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113372'
references:
  - url: >-
      https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html
  - url: 'https://support.sonatype.com/hc/en-us/articles/56612283547539/'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.527Z'
epss: 0.00215
epssPercentile: 0.11994
---

## Overview

Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.

## Affected

- `nexus_repository_3 >= 3.93.0 < 3.98.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.