CVE-2026-113370
Description
A flaw was found in Sonatype Nexus Repository. An authenticated user with task creation privileges can modify records in the underlying application database by exploiting a Structured Query Language (SQL) injection vulnerability. When the optional search reindexing task is enabled, an attacker can submit a crafted filter condition that is executed directly as SQL commands by the database.
Statement
This vulnerability is rated as an Important severity because successful exploitation grants arbitrary SQL execution against the underlying database, leading to potential data tampering, unauthorized disclosure, or loss of database integrity. Exploitation requires network access with task creation privileges and relies on the non-default configuration setting nexus.reindex.search.by.pattern.visible being set to true. Environments running standard default configurations without this setting enabled, or where task administration privileges are restricted, are not exposed.
Mitigation
To mitigate this vulnerability, disable the pattern reindexing feature and restrict user privileges:
1. Disable the pattern reindexing task setting:
Ensure the following property is set to false in the `nexus.properties` configuration file (or remove the line to restore default behavior):
nexus.reindex.search.by.pattern.visible=false
2. Restrict task creation privileges:
Review user roles in the Nexus Repository administration console and revoke the `nexus:tasks:create` privilege from untrusted or non-administrative accounts.
Warning: Modifying `nexus.properties` requires a restart of the Nexus service for settings to take effect, which will cause temporary service interruption. Disabling this task feature prevents operators from executing pattern-based search reindexing.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to parameterize SQL queries and bound statements for search reindexing filters to prevent user-supplied filter inputs from executing directly as SQL commands against the database: upgrade to Sonatype Nexus Repository 3.98.0 (or the fixed Nexus builds), which eliminate free-form filter inputs in the search reindexing task, closing crafted filter condition in search reindexing task. Until patched, this is only a concern on Sonatype Nexus Repository deployments with nexus.reindex.search.by.pattern.visible enabled and user task creation privileges granted — Standard default configurations where nexus.reindex.search.by.pattern.visible is set to false or absent are unaffected — so Set nexus.reindex.search.by.pattern.visible=false in nexus.properties and restart the service, and revoke the nexus:tasks:create privilege from untrusted accounts. As a compensating measure, Inspect incoming HTTP task creation requests with a web application firewall to block SQL injection payloads at the network perimeter, Apply database least-privilege controls to the Nexus database account to restrict destructive and administrative SQL operations, and Enforce strict allowlisting on search filter inputs to reject arbitrary SQL syntax before reaching the query engine. These controls limit blast radius and contain exploitation, but they do not fix the underlying SQL injection defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1305 SQL Injection Prevention (Parameterized Queries) (high)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
Adversaries could execute system commands, typically by changing the SQL statement to redirect output to a file that can then be executed.
Confidentiality
Technical Impact: Read Application Data
Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL injection vulnerabilities.
Authentication
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
If poor SQL commands are used to check user names and passwords or perform other kinds of authentication, it may be possible to connect to the product as another user with no previous knowledge of the password.
Access Control
Technical Impact: Bypass Protection Mechanism
If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability.
Integrity
Technical Impact: Modify Application Data
Just as it may be possible to read sensitive information, it is also possible to modify or even delete this information with a SQL injection attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
