CVE Intelligence
Analysis AI-assisted

CVE-2026-5189: Sonatype Nexus Repository - Hard-coded Credential in Internal Database Component

CWE-798 in Sonatype Nexus Repository and Nexus Repository Manager may let an unauthenticated network attacker gain read and write access to the internal database and run OS commands as the Nexus process user. The record says exploitation requires the non-default nexus.orient.binaryListenerEnabled=true setting. The NVD record gives a base score of 9.8, and the CISA KEV catalog does not list this CVE.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Sonatype published CVE-2026-5189 for Sonatype Nexus Repository and Nexus Repository Manager. The record classifies the weakness as CWE-798, use of hard-coded credentials, in an internal database component. The NVD record gives a base score of 9.8 and a critical severity rating.

Impact

  • According to the description, an unauthenticated attacker with network access could gain unauthorized read and write access to the internal database.
  • The description also states that this could allow arbitrary operating system commands to run as the Nexus process user.
  • The SSVC data in the record marks the issue as automatable and gives a total technical impact.

Affected products and versions

  • The record lists Sonatype Nexus Repository and Sonatype Nexus Repository Manager for versions from 3.0.0 up to and including 3.70.5, expressed in the affected range as at least 3.0.0 and before 3.71.0.
  • Exploitation requires the non-default setting nexus.orient.binaryListenerEnabled=true.
  • The record does not include a separate list of fixed versions.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The SSVC exploitation field is none. The EPSS probability is 0.00616 with a percentile of 0.48908.

Remediation and mitigation

  • Review the Sonatype support advisory and plan an upgrade to the release the vendor identifies as fixed. The record links the Nexus Repository 3.71.0 release notes with a patch tag.
  • Until the upgrade is complete, check whether nexus.orient.binaryListenerEnabled is set to true. If the setting is not required, keep it disabled.
  • Restrict network access to Nexus Repository instances and their internal database interface using network segmentation and access control lists.

Detection guidance

  • Audit Nexus configurations for the non-default setting and track its state across all instances.
  • Review access logs and authentication events for unexpected connections to the internal database component and for unexpected child processes started by the Nexus service account.
  • Treat any sign of unauthorized access as a security incident and follow your incident response process.

Limitations of the available information

  • The record does not state the fixed version explicitly, and the full text of the vendor advisory is not included in the record.
  • The record provides no technical details beyond the description, and this analysis does not add any.
  • The EPSS date in the record is 2026-10-23, so the score should be checked against the date of reading.
  • Scores from different providers are listed in the record, but the record does not explain how they relate to one another.

Frequently asked questions

Which versions are affected by CVE-2026-5189?

The record lists Sonatype Nexus Repository and Nexus Repository Manager from 3.0.0 up to and including 3.70.5, with an affected range of at least 3.0.0 and before 3.71.0.

Does this vulnerability require a special configuration?

Yes. The record states that exploitation requires the non-default setting nexus.orient.binaryListenerEnabled=true to be enabled.

Is this CVE known to be exploited in the wild?

The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.