CVE-2026-113374
Description
A flaw was found in nexus. This vulnerability allows privilege escalation when an authenticated user with capability creation permissions enables the Rut Auth capability without requiring realm administration authorization. This action turns on header-based authentication for the instance, enabling a remote attacker to bypass authentication and log in as any existing user, including an administrator, without providing credentials.
Statement
This vulnerability is rated as Important because exploitation requires valid credentials with capability-creation privileges, preventing direct unauthenticated compromise across the network. Although activating this feature enables header-based authentication that allows subsequent requests to bypass authentication controls and impersonate administrative accounts, the prerequisite access level keeps the severity below Critical. Under standard enterprise deployments, capability-level roles are restricted to administrative personnel, substantially limiting the likelihood of unauthorized privilege escalation.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to require realm administration privileges before enabling Rut Auth to prevent unauthorized activation of header-based authentication: upgrade to Sonatype Nexus Repository 3.98.0 (or the fixed Nexus builds), which require realm administration authorization before allowing Rut Auth capability creation, closing all 2 injection vectors (unauthorized Rut Auth capability creation, header-based authentication impersonation). Until patched, this is a concern on Nexus Repository deployments where users possess capability creation permissions (nexus:capabilities:create), so restrict nexus:capabilities:create permissions strictly to trusted administrators and audit existing configurations to remove unauthorized Rut Auth capabilities or realms. As a compensating measure, detect unauthorized activation of the Rut Auth capability by alerting when runtime configuration drifts from the declared baseline and capture and forward application management events to SIEM to detect capability creation or initiation of header-based authentication. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing authorization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1007 Application Configuration Drift Detection (IaC Enforcement) (medium)
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
