CVE-2026-113370 in Nexus Repository
Summary
by MITRE • 11/04/2026
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus database. The task is available only when the non-default setting nexus.reindex.search.by.pattern.visible is set to true.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Sonatype Nexus Repository 3 represents a critical security flaw within an administrative utility designed for repository maintenance, specifically the Reindex Search Tables By Pattern feature. This functionality allows administrators to re-index search tables based on specific patterns, which is essential for maintaining search performance and accuracy after significant changes to hosted repositories or artifacts. However, the implementation of this task contains a fundamental input validation error that permits SQL injection attacks when certain configuration conditions are met. The vulnerability specifically targets users who possess the nexus:tasks:create privilege, a role typically assigned to system administrators or DevOps engineers responsible for managing repository operations and automation scripts within the Nexus environment.
The technical root cause lies in how the application processes user-supplied filter conditions passed to this specific task. Instead of properly sanitizing or parameterizing these inputs before execution, the software concatenates them directly into SQL query strings that are subsequently executed against the underlying database. This lack of proper input handling allows an authenticated attacker with sufficient privileges to inject arbitrary SQL commands. By crafting a malicious filter condition, the attacker can manipulate the structure and content of the queries run by the database engine. This capability extends beyond simple data retrieval; it enables the modification, deletion, or insertion of records within the Nexus repository's internal database schema.
The operational impact of this vulnerability is severe due to its potential for full system compromise through data manipulation. An attacker leveraging this SQL injection can alter metadata associated with hosted repositories, potentially introducing malicious artifacts that appear legitimate to downstream consumers. They could also corrupt search indices, leading to service denial by making valid packages unsearchable or returning incorrect results. Furthermore, depending on the database configuration and privileges granted to the Nexus application user account, an attacker might escalate their access to execute operating system commands via database-specific features such as xp_cmdshell in Microsoft SQL Server or similar functions in other relational databases. This transforms a repository management tool into a vector for complete infrastructure compromise, affecting not only the integrity of software supply chains but also potentially exposing sensitive internal data stored within the Nexus instance.
The exploitability of this vulnerability is contingent upon specific configuration settings that are disabled by default to mitigate risk. The Reindex Search Tables By Pattern task is hidden and inaccessible unless the non-default setting nexus.reindex.search.by.pattern.visible is explicitly set to true in the system properties or environment variables. This design choice suggests that Sonatype recognized the potential risks associated with this feature but left it enabled for organizations requiring advanced re-indexing capabilities without automatic restriction. Consequently, any organization that has manually enabled this visibility option and granted task creation privileges to users who should not have administrative access is at immediate risk. The presence of this configuration toggle indicates a defense-in-depth strategy where the vulnerability exists in code logic rather than being an inherent flaw in all default deployments, yet it remains critical for those specific configurations.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The most effective immediate action is to disable the vulnerable feature by ensuring that nexus.reindex.search.by.pattern.visible is set to false or removed from configuration files if not strictly required for operational workflows. Organizations should audit their user roles and permissions, restricting the nexus:tasks:create privilege only to trusted administrators who fully understand the security implications of enabling advanced tasks. Additionally, applying the latest available patches from Sonatype that address this specific SQL injection flaw is essential. From a broader perspective, developers must implement strict input validation using parameterized queries or prepared statements for all database interactions involving user-supplied data. This ensures that inputs are treated as literal values rather than executable code, neutralizing injection attempts regardless of the context in which they appear.
This vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. It also maps to MITRE ATT&CK techniques related to Data Manipulation and potentially Privilege Escalation if database-level command execution is possible. The scenario illustrates the danger of exposing administrative functions through web interfaces without adequate safeguards against injection attacks. Security teams should review their Nexus configurations regularly to ensure that non-default features remain disabled unless absolutely necessary, thereby reducing the attack surface available to potential adversaries who have gained initial access or elevated privileges within the application layer.