CVE-2026-5189

CRITICAL

Nexus Repository 3 - Hardcoded Credential in Internal Database Component

Title source: cna
STIX 2.1

Description

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

References (2)

Core 2

Scores

CVSS v4 9.2
EPSS 0.0046
EPSS Percentile 36.3%
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-798
Status published
Products (1)
Sonatype/Nexus Repository 3.0.0 - 3.71.0
Published Apr 15, 2026
Tracked Since Apr 16, 2026