Sonatype Nexus Repository Manager up to 3.92.x Configuration authorization

Summaryinfo

A vulnerability was found in Sonatype Nexus Repository Manager up to 3.92.x. It has been declared as problematic. This issue affects some unknown processing of the component Configuration Handler. Executing a manipulation can lead to authorization. This vulnerability is tracked as CVE-2026-10741. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Sonatype Nexus Repository Manager up to 3.92.x. It has been declared as problematic. This vulnerability affects some unknown processing of the component Configuration Handler. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect confidentiality. CVE summarizes:

Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.

The weakness was disclosed by Ho Boon Suan. The advisory is shared for download at help.sonatype.com. This vulnerability was named CVE-2026-10741 since 06/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.93.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-37783) and CERT Bund (WID-SEC-2026-1987). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Sonatype Nexus Repository Manager

Productinfo

Vendor

• Sonatype

Name

• Nexus Repository Manager

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37
• 3.38
• 3.39
• 3.40
• 3.41
• 3.42
• 3.43
• 3.44
• 3.45
• 3.46
• 3.47
• 3.48
• 3.49
• 3.50
• 3.51
• 3.52
• 3.53
• 3.54
• 3.55
• 3.56
• 3.57
• 3.58
• 3.59
• 3.60
• 3.61
• 3.62
• 3.63
• 3.64
• 3.65
• 3.66
• 3.67
• 3.68
• 3.69
• 3.70
• 3.71
• 3.72
• 3.73
• 3.74
• 3.75
• 3.76
• 3.77
• 3.78
• 3.79
• 3.80
• 3.81
• 3.82
• 3.83
• 3.84
• 3.85
• 3.86
• 3.87
• 3.88
• 3.89
• 3.90
• 3.91
• 3.92

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion