Which versions of Nexus Repository Manager are affected by CVE-2026-11403?

Sonatype Nexus Repository Manager versions prior to 3.93.0 contain a weak API key generation flaw (CVE-2026-11403, CVSS 8.7) enabling attackers to predict or reconstruct valid user credentials and…. A patch is available.

How to fix or mitigate CVE-2026-11403?

Within 24 hours, inventory all Sonatype Nexus Repository Manager instances and document current versions to identify exposure scope. Within 7 days, plan and validate the upgrade to version 3.93.0 in a staging environment, reviewing API key rotation policies and access logs for anomalies. Within 30 days, complete the upgrade to version 3.93.0 across all production deployments and conduct a security audit of repository operations and API key usage patterns for the preceding 90 days to identify potential unauthorized access.

Nexus Repository Manager CVE-2026-11403

Q: What is the CVSS score of CVE-2026-11403?

CVE-2026-11403 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43724 HIGH

Insufficient Entropy (CWE-331)

2026-07-14 Sonatype

GHSA-h5r5-2h4m-2rx5

Authentication Bypass Docker Node.js Nexus Repository Manager Sonatype

8.7

CVSS 4.0 · Vendor: Sonatype

Severity by source

Vendor (Sonatype) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network, unauthenticated (PR:N), but AC:H because a specific realm must be enabled and the victim must hold an active key; C:H with limited integrity (I:L) from acting as the user.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 16:06 vuln.today

CVE Published

Jul 14, 2026 - 15:28 cve.org

HIGH 8.7

DescriptionCVE.org

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.

Articles & Coverage 1

News 3 New Node.js Vulnerabilities - 3 High Severity Jul 14, 2026

AnalysisAI

Improper API key generation in Sonatype Nexus Repository Manager lets a remote attacker impersonate a targeted user and perform repository operations on their behalf. The flaw stems from insufficient entropy (CWE-331) in format-specific API key realms, so an attacker who can predict or reconstruct a victim's key gains their access without credentials. The vendor (Sonatype) reported and patched the issue in release 3.93.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Nexus Repository Manager is a widely used artifact/package repository server that brokers Java (Maven), NuGet, Docker, and npm content, among others. To support tooling that authenticates non-interactively, Nexus offers format-specific API key realms - NuGet API Key, Docker Bearer Token, and npm Bearer Token - each of which issues a per-user token. The root cause is CWE-331 (Insufficient Entropy): the algorithm generating these format-specific keys does not draw from a sufficiently unpredictable source, so a key value can be guessed or derived rather than being cryptographically unguessable. Because the token is treated as proof of identity, a predictable token collapses the authentication boundary and grants an attacker the same repository operations the legitimate user's token would authorize. The single affected CPE is cpe:2.3:a:sonatype:nexus_repository_manager, i.e. the Nexus Repository 3.x line prior to 3.93.0.

RemediationAI

Vendor-released patch: upgrade to Sonatype Nexus Repository 3.93.0 or later, per the 3.93.0 release notes (https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html) and the vendor advisory (https://support.sonatype.com/hc/en-us/articles/52347011450515/). If you cannot patch immediately, disable the format-specific API key realms (NuGet API Key, Docker Bearer Token, npm Bearer Token) that are not strictly required, which removes the vulnerable code path but will break NuGet/Docker/npm clients that authenticate with those tokens and force them onto other auth mechanisms. As a further compensating control, invalidate/regenerate existing users' API keys after upgrading so any keys that were predictable are retired, and restrict network access to the Nexus web/API endpoints to trusted CI/CD networks to shrink the remote attack surface; the trade-off is added friction for distributed developers and build agents that reach Nexus directly.