Sonatype fixes seven Nexus Repository flaws enabling SSO bypass and privilege escalation

Sonatype has released Nexus Repository 3 version 3.98.0 to address seven security flaws across its platform, with the highest CVSSv4 score assigned to CVE-2026-113373 (9.1). The flaws span an SSO bypass, privilege escalation via Rut Auth capability, a SQL injection, and several credential and data exposure issues, affecting multiple branches of Nexus Repository 3 CE and Pro prior to 3.98.0. According to Sonatype, none of the bugs were actively exploited at the time of the patch.

The CVEs covered are CVE-2026-113373, CVE-2026-113374, CVE-2026-113370, CVE-2026-113371, CVE-2026-113372, CVE-2026-113369 and CVE-2026-113368, with affected versions ranging across 3.0.0 through 3.97.x for various flaws. The patch is delivered as Nexus Repository 3.98.0, which also disables stored script runs by default unless nexus.scripts[.]allowExecution is set to true.

The article explains how the flaws work: CVE-2026-113373 enables a sign-in bypass for locked local accounts when users authenticate via SAML or OAuth2, letting them obtain a fresh session with prior roles. CVE-2026-113374 allows a user with nexus:capabilities:create to enable header logins without realm admin rights, letting an attacker log in as any existing user, including an admin, with no password.

Other issues include SQL injection in the Reindex Search by Pattern task (CVE-2026-113370), and disclosure of repo signing keys and passphrases (CVE-2026-113372 and CVE-2026-113371) plus a stored XSS in OCI attestations (CVE-2026-113369) and a group-repository member authorization bypass (CVE-2026-113368).

Post-patch guidance calls for checking login logs for rogue SSO activity, removing any rogue Rut Auth rules or realms, rotating affected signing keys and passphrases, and tightening group and OCI edit permissions.