CVE-2026-113371
Description
A flaw was found in Sonatype Nexus Repository. An authenticated user with read-only administrative privileges can trigger sensitive information disclosure through an internal REST (Representational State Transfer) endpoint. The application returns the repository signing passphrase for package repositories without verifying that the requesting user has edit permissions. This exposure could allow an attacker to obtain cryptographic credentials and produce unauthorized signed packages.
Statement
Red Hat has rated this vulnerability as Moderate because exploitation requires an authenticated account that already holds administrative read access to repository configurations. Although unauthorized retrieval of package signing passphrases compromises credential confidentiality and could facilitate rogue package signing, the attack cannot be launched by unauthenticated or unprivileged users. The impact is therefore constrained to environments where repository administrative read permissions are granted to untrusted parties.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
