Sonatype has released Nexus Repository 3.98.0 to fix seven vulnerabilities, led by CVE-2026-113373, a single sign-on flaw rated 9.1 on the CVSS v4 scale. Versions before 3.98.0 are affected, and Sonatype reports no exploitation and no public exploit tools.
CVE-2026-113373 Lets Locked Accounts Sign Back In
The most serious flaw affects the Pro edition. When a user signs in through SAML or OAuth2, the server does not check whether the local account is disabled or locked. A user whose account has been locked, but who still holds valid credentials at the identity provider, can therefore sign in again.
The fix is part of a set covering CVE-2026-113368 through CVE-2026-113374.
Privilege Escalation Through a Rut Auth Capability
CVE-2026-113374, scored 8.6, is a privilege escalation flaw involving the creation of a Rut auth capability. The coverage does not describe the exploit path in more detail.
SQL Injection in the Reindex-Search Task
CVE-2026-113370, scored 7.7, is a SQL injection in the reindex-search-by-pattern task. SQL injection lets an attacker influence database queries, and in this case it sits in an administrative task.
Signing Key Weaknesses in CVE-2026-113371 and CVE-2026-113372
CVE-2026-113371 and CVE-2026-113372 both carry a score of 7.1. One concerns insufficient protection of the repository signing passphrase, and the other concerns the YUM signing key. Nexus stores packages, container images and signing keys, so weak protection of signing material bears on the integrity of software distributed from a repository.
CVE-2026-113369 and CVE-2026-113368 in Nexus 3.98.0
CVE-2026-113369, scored 6.3, is a stored cross-site scripting flaw in the OCI Attestations tab. CVE-2026-113368, scored 5.3, is an authorization bypass involving group repository members.
Sonatype on Exploitation and Nexus Exposure
Sonatype reports no exploitation and no public exploit tools for any of the seven flaws. SecurityOnline estimates that more than 100,000 firms use Nexus. That estimate comes from the outlet and not from Sonatype.
Why Repository Managers Hold Supply Chain Risk
A compromised repository manager sits at the point where build artifacts and signing keys meet. The coverage notes that account takeover, administrator escalation and signing-key exposure are the potential consequences of the flaws, all of which could affect build infrastructure.
Upgrading Nexus Repository to 3.98.0
The fix ships in 3.98.0. The advisory coverage also points administrators to review realm and repository settings after upgrading. The sources describe these as the response steps and do not give a deadline.
The seven flaws vary widely in severity, from the 9.1 authentication gap to the 5.3 authorization bypass. Only the top-scoring issue is limited to the Pro edition according to the reporting, while the sources do not specify editions for the others.
The release was published and reported on Nov. 6. Sonatype’s statement that no exploitation has occurred means the advisory is preventive. The authentication bypass involves a condition that is easy to describe, since the account status is simply not checked at login through external identity providers, though the coverage does not say how attackers would obtain valid provider credentials for a locked account.
Taken together, the seven fixes cover authentication, authorization, injection, key protection and script injection in a product that stores the components organizations use to build and ship software.
Severity Spread Across CVE-2026-113368 to CVE-2026-113374
The seven CVEs run from 5.3 to 9.1 on the CVSS scale. Besides the 9.1 SSO flaw and the 8.6 privilege escalation, the set includes a 7.7 SQL injection, two 7.1 signing-material weaknesses, a 6.3 stored cross-site scripting flaw and a 5.3 group-repository authorization bypass. Sonatype published the fixes in release 3.98.0, and SecurityOnline reported the details on Nov. 6.
Nexus Repository 3 Versions Before 3.98.0 Are Affected
All versions of Nexus Repository 3 before 3.98.0 fall within the scope of the advisory. Nexus stores packages, container images and signing keys, which is why SecurityOnline frames a compromise as a supply-chain risk. The OCI Attestations tab, the reindex-search task, the group repository member logic and the signing configuration are the specific components named across the seven CVEs.
