Hard-coded Credentials Vulnerability in Sonatype Nexus Repository Manager
CVE-2026-5189

9.2CRITICAL

Key Information:

Vendor

Sonatype

Status
Nexus Repository
Vendor
CVE Published:
15 April 2026

What is CVE-2026-5189?

A vulnerability in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 arises from the use of hard-coded credentials. This flaw enables unauthenticated attackers with network access to gain unauthorized read/write access to the internal database, and execute arbitrary operating system commands as the Nexus process user. Exploitation can occur only if the non-default configuration parameter 'nexus.orient.binaryListenerEnabled=true' is enabled, further complicating the security posture of affected systems.

Affected Version(s)

Nexus Repository 3.0.0 < 3.71.0

References

https://help.sonatype.com/en/sonatype-nexus-repository-3-...
patch
https://support.sonatype.com/hc/en-us/articles/5081713882...
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shreyas Chavhan, HackerOne: @shreyaschavhan
.