CVE-2026-1133707.7High
CVE-2026-113370: Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task
Sonatype · Nexus Repository 3
Vendor fix available · Affected: Sonatype Nexus Repository 3 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.2%probability of exploitation in the next 30 days
11th percentile
050100
Higher than 11% of scored CVEs
7.7HighCVSS
LowMediumHighCrit.
DescriptionNVD
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 6 Nov.
- Sonatype fixes seven Nexus Repository flaws enabling SSO bypass and privilege escalationSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.