CVE-2026-10741: Nexus Repository Manager Credential Disclosure Vulnerability

Technical summary

The vulnerability exists in the proxy repository configuration logic of Nexus Repository Manager, classified as an authorization bypass affecting credential confidentiality (CWE-863). The flaw permits a delegated repository administrator—a user with restricted administrative privileges—to read stored upstream proxy credentials through the repository configuration interface. The attack requires high privilege level (PR:H) and produces no impact on integrity or availability; the sole risk is confidential disclosure of authentication material. The vulnerability is context-specific to proxy repository setups where upstream authentication is required.

Business impact

Credential disclosure at the administrative level can lead to unauthorized access to upstream repositories or related systems that share credentials. If upstream proxy servers are used to access sensitive artifact sources, compromised credentials could allow an attacker (with initial admin access) to intercept, modify, or exfiltrate supply chain artifacts. Organizations using Nexus for critical software delivery pipelines face risk of lateral movement if those upstream credentials are reused elsewhere. The impact is contained to organizations where delegated repository admins exist and upstream proxy credentials are present.

Affected systems

Sonatype Nexus Repository Manager versions prior to 3.93.0 are affected. Organizations running 3.93.0 or later are not vulnerable. The vulnerability only manifests in instances where proxy repositories with stored upstream credentials are configured; Nexus deployments without proxy repositories or without delegated administrator accounts have reduced exposure.

Exploitability

Exploitation requires existing administrative credentials with delegated repository management authority. No network vulnerability or user interaction is necessary; the attacker must already possess admin-level access to the Nexus instance. This is a privilege escalation within the administrative tier—a delegated admin can see what they are not intended to see. The attack surface is internal and limited to users with admin panel access. There is no known public exploit, and this vulnerability is not tracked in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Sonatype Nexus Repository Manager to version 3.93.0 or later. Organizations unable to upgrade immediately should audit proxy repository configurations and restrict delegated administrator roles to the minimum necessary permissions, and consider removing upstream credentials from the Nexus configuration if they can be supplied at request time instead. Review access logs to detect if delegated admins have accessed credential configuration pages.

Patch guidance

Apply the official Sonatype patch by upgrading to Nexus Repository Manager 3.93.0 or a later release. Verify compatibility with your current plugins and configuration before deploying to production. Sonatype provides detailed upgrade instructions and migration notes in their release documentation; consult the vendor advisory for version-specific steps. Plan the upgrade during a maintenance window, as repository access may be briefly interrupted.

Detection guidance

Monitor audit logs for delegated administrators accessing proxy repository configuration, particularly credential fields. Track configuration changes related to upstream proxy credentials. If you maintain HTTP traffic logs, look for unusual access to the Nexus API endpoints related to repository proxy settings (typically under /service/rest/v1/repositories). Search for admin users querying credential storage or performing unauthorized configuration reads. Correlate admin activity with subsequent external connections to upstream repositories.

Why prioritize this

This vulnerability warrants medium priority because it requires high-level privileges to exploit and has no known active exploitation. However, it represents a control failure—delegated admins should not access credentials outside their scope—and could enable further attacks if upstream systems share credentials with other services. Prioritize remediation for Nexus instances in high-trust supply chain roles or where upstream credentials have elevated privilege.

Risk score, explained

CVSS 3.1 score of 4.9 (MEDIUM) reflects the high barrier to exploitation (requires admin access, network-adjacent but not remote unauthenticated) balanced against the severity of credential disclosure. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates that while confidentiality impact is high, integrity and availability are unaffected, and the attack requires existing high privileges. This is a moderate risk suitable for standard patching cycles but not emergency response.

Frequently asked questions