CVE-2026-113374Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation

Açıklama

Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-based authentication for the instance. A remote client can then authenticate as an existing user, including an administrator, without credentials.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html patch
• https://support.sonatype.com/hc/en-us/articles/56616522124435/ vendor-advisory