Skip to main content

Nexus Repository EUVDEUVD-2026-23031

| CVE-2026-5189 CRITICAL
Use of Hard-coded Credentials (CWE-798)
2026-04-15 Sonatype GHSA-4gcp-x7jh-x4v7
Authentication Bypass Nexus Repository
9.2
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Generated
Jul 26, 2026 - 15:19 vuln.today
CVSS changed
Apr 15, 2026 - 19:22 NVD
9.2 (CRITICAL)
EUVD ID Assigned
Apr 15, 2026 - 19:15 euvd
EUVD-2026-23031
Patch released
Apr 15, 2026 - 19:15 nvd
Patch available
CVE Published
Apr 15, 2026 - 18:43 nvd
CRITICAL 9.2

DescriptionCVE.org

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

AnalysisAI

Hard-coded credentials in Sonatype Nexus Repository 3.0.0 through 3.70.5 allow unauthenticated attackers with network access to gain read/write access to the internal OrientDB database and execute arbitrary operating system commands as the Nexus process user when the nexus.orient.binaryListenerEnabled configuration is enabled. Exploitation

More in Nexus Repository

View all
CVE-2026-10748 HIGH
8.6 Jun 16

Arbitrary OS command execution in Sonatype Nexus Repository 3 versions prior to 3.92.0 allows authenticated users holdin
CVE-2026-17593 HIGH
7.2 Aug 07

Remote code execution in Sonatype Nexus Repository 3 (and legacy Nexus Repository 2) is achievable by any account holdin
CVE-2026-7494 MEDIUM
5.3 Jul 14

Server-Side Request Forgery in Sonatype Nexus Repository 3 exposes internal network infrastructure to authenticated user
CVE-2026-7308 MEDIUM
5.1 May 11

Stored cross-site scripting (XSS) in Sonatype Nexus Repository 3.6.0 through 3.91.x allows authenticated users with uplo
CVE-2026-3048 MEDIUM
5.1 May 11

Server-side request forgery with deserialization characteristics in Sonatype Nexus Repository Manager 3.0.0 through 3.91

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-23031 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy