CVE-2026-11403 | A vulnerability in Sonatype Nexus Repository Manager's forma… | CVSS 8.7 HIGH

Description

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.

Metadata

CVE ID: CVE-2026-11403
State: PUBLISHED
Assigner: Sonatype
Reserved: 2026-06-05 16:41 UTC
Published: 2026-07-14 15:28 UTC
Last updated: 2026-07-14 15:59 UTC
Primary CWE: CWE-331
CWE-331 Insufficient entropy
Vendor / Product: Sonatype / Nexus Repository Manager
Sources: cve.org · NVD

Severity & Metrics

8.7 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Sonatype	Nexus Repository Manager	—	3.0.0 < 3.93.0

Weakness (CWE)

CWE	Source	Description
CWE-331	cna	CWE-331 Insufficient entropy

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References (2)