CVE-2026-10741: Nexus Repository Manager Info Disclosure

CVE-2026-10741 Overview

CVE-2026-10741 is an authorization vulnerability in Sonatype Nexus Repository Manager versions before 3.93.0. The flaw resides in the proxy repository configuration logic, where access controls fail to restrict credential disclosure to delegated administrators. A delegated repository administrator can read stored upstream proxy credentials that should remain accessible only to higher-privileged users. The weakness is classified under CWE-863: Incorrect Authorization. Exploitation requires authenticated access with the delegated administrator role, limiting the attacker pool but enabling credential theft within multi-tenant Nexus deployments.

Critical Impact
Delegated repository administrators can extract stored upstream proxy credentials, enabling lateral access to external package registries and supply chain compromise paths.

Affected Products

Sonatype Nexus Repository Manager versions prior to 3.93.0
Proxy repository configurations storing upstream registry credentials
Deployments using delegated repository administration roles

Discovery Timeline

2026-06-17 - CVE-2026-10741 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-10741

Vulnerability Analysis

Nexus Repository Manager supports proxy repositories that cache artifacts from upstream sources such as Maven Central, npm, or private registries. When the upstream source requires authentication, administrators store credentials within the proxy repository configuration. These credentials should be readable only by users with full administrative privileges.

The vulnerability allows a delegated repository administrator, a lower-privileged role intended to manage a subset of repositories, to read the stored upstream credentials through the repository configuration interface. The authorization layer does not enforce the privilege boundary that distinguishes credential viewing from repository management.

Once extracted, credentials can be reused outside Nexus to access the upstream registry directly. Attackers can then publish malicious packages, pull private artifacts, or pivot into connected build pipelines.

Root Cause

The root cause is an incorrect authorization check ([CWE-863]) in the proxy repository configuration handler. The code path that returns repository settings does not differentiate between the privilege required to manage a repository and the privilege required to view sensitive secrets attached to it. As a result, the credential field is serialized to any user with delegated administrative rights over the target repository.

Attack Vector

The attack vector is network-based and requires high privileges in the form of an authenticated delegated administrator account. No user interaction is required. The attacker navigates to the proxy repository configuration belonging to a repository they manage and retrieves the upstream credentials through the user interface or REST API. The vulnerability impacts confidentiality only; integrity and availability of the Nexus instance itself remain unaffected.

The vulnerability is described in the Sonatype Nexus 3.93.0 Release Notes and the corresponding Sonatype Support Article.

Detection Methods for CVE-2026-10741

Indicators of Compromise

Access to proxy repository configuration endpoints by accounts holding only delegated administrator roles
Unexpected REST API calls to /service/rest/v1/repositories/* from delegated admin sessions
Outbound authentication attempts to upstream registries originating from hosts other than the Nexus server
Audit log entries showing repository configuration reads without corresponding write operations

Detection Strategies

Review Nexus audit logs for repository.configuration.read events tied to non-system administrator accounts
Correlate delegated administrator activity with subsequent authentication events on upstream package registries
Alert on enumeration patterns where a single account reads multiple proxy repository configurations within a short window

Monitoring Recommendations

Enable verbose audit logging for repository configuration access in Nexus Repository Manager
Forward Nexus access and audit logs to a centralized SIEM for behavioral analysis
Monitor upstream registry authentication logs for credential use from unexpected source IP addresses
Track changes to role assignments that grant the delegated repository administrator privilege

How to Mitigate CVE-2026-10741

Immediate Actions Required

Upgrade Sonatype Nexus Repository Manager to version 3.93.0 or later
Rotate all upstream proxy credentials stored in any proxy repository configuration
Audit current role assignments and remove delegated repository administrator privileges that are not required
Review historical audit logs for prior access to proxy repository configurations by delegated administrators

Patch Information

Sonatype addressed the authorization flaw in Nexus Repository Manager 3.93.0. The fix enforces stricter privilege checks before returning stored credentials in proxy repository configuration responses. Refer to the Sonatype Nexus 3.93.0 Release Notes and the Sonatype Support Article for upgrade guidance.

Workarounds

Restrict the delegated repository administrator role to trusted operators only until patching is complete
Replace stored upstream credentials with short-lived tokens or accounts that have least-privilege access to the upstream registry
Place proxy repositories that require credentials under repositories that delegated administrators do not manage
Segment network egress so that upstream registry credentials cannot be reused outside the Nexus server

bash

# Verify Nexus Repository Manager version after upgrade
curl -u admin:<password> \
  https://nexus.example.com/service/rest/v1/status \
  -H "Accept: application/json"

# List users assigned the delegated repository administrator role for review
curl -u admin:<password> \
  https://nexus.example.com/service/rest/v1/security/users \
  -H "Accept: application/json"