CVE-2026-5189: Nexus Repository Manager RCE Vulnerability

CVE-2026-5189 Overview

CVE-2026-5189 is a critical hardcoded credentials vulnerability affecting Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5. This vulnerability allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

Critical Impact

Successful exploitation enables complete compromise of the Nexus Repository Manager, including unauthorized database access, data exfiltration, and arbitrary command execution on the underlying system with the privileges of the Nexus service account.

Affected Products

• Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5
• Systems with nexus.orient.binaryListenerEnabled=true configuration enabled

Discovery Timeline

• 2026-04-15 - CVE-2026-5189 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-5189

Vulnerability Analysis

This vulnerability stems from the use of hard-coded credentials (CWE-798) within the Sonatype Nexus Repository Manager's OrientDB binary listener component. When the non-default configuration option nexus.orient.binaryListenerEnabled=true is enabled, the internal OrientDB database becomes accessible over the network using embedded credentials that cannot be changed by administrators.

The vulnerability allows unauthenticated attackers to bypass authentication entirely and interact directly with the internal database. This access provides full read and write capabilities to all stored data, including repository configurations, user credentials, and artifact metadata. Furthermore, the attack surface extends beyond data access—attackers can leverage database functionality to execute arbitrary operating system commands under the context of the Nexus process user.

Root Cause

The root cause of this vulnerability is the presence of hard-coded credentials embedded within the application code for the OrientDB binary listener interface. These credentials are compiled into the application and cannot be modified or rotated by system administrators, creating a persistent backdoor when the binary listener is enabled.

The OrientDB binary protocol listener, when activated, exposes a network service that accepts connections authenticated with these static credentials. This design flaw violates fundamental security principles of credential management and defense-in-depth.

Attack Vector

The attack vector is network-based and requires no prior authentication or user interaction. An attacker with network access to the Nexus Repository Manager instance can exploit this vulnerability through the following attack chain:

1. The attacker identifies a Nexus Repository Manager instance with the binary listener enabled (typically listening on a separate port from the web interface)
2. Using the hard-coded credentials, the attacker authenticates to the OrientDB binary protocol
3. Once authenticated, the attacker gains full database access with read/write capabilities
4. The attacker can extract sensitive data, modify repository configurations, or leverage OrientDB's command execution features to run arbitrary OS commands

The exploitation is conditional on the nexus.orient.binaryListenerEnabled=true setting being enabled, which is not the default configuration. However, organizations that have enabled this feature for legitimate purposes are at immediate risk.

Detection Methods for CVE-2026-5189

Indicators of Compromise

• Unexpected network connections to the OrientDB binary protocol port (default: 2424)
• Unusual database queries or modifications not attributable to legitimate Nexus operations
• Evidence of command execution originating from the Nexus process user account
• Anomalous file access or creation in directories writable by the Nexus service account
• Authentication logs showing successful database connections from unauthorized sources

Detection Strategies

• Monitor network traffic for connections to the OrientDB binary protocol port from unexpected sources
• Implement network segmentation rules that alert on external access attempts to internal database ports
• Review Nexus configuration files for the presence of nexus.orient.binaryListenerEnabled=true
• Deploy endpoint detection to identify suspicious process execution chains originating from the Nexus Java process

Monitoring Recommendations

• Enable comprehensive logging for the OrientDB component within Nexus Repository Manager
• Configure SIEM rules to detect and alert on database protocol traffic to/from the Nexus server
• Implement file integrity monitoring on Nexus configuration and data directories
• Establish baseline network behavior for Nexus instances and alert on deviations

How to Mitigate CVE-2026-5189

Immediate Actions Required

• Verify whether nexus.orient.binaryListenerEnabled=true is configured in your Nexus instances by checking the nexus.properties configuration file
• If the binary listener is enabled, immediately disable it by setting nexus.orient.binaryListenerEnabled=false or removing the configuration entry
• Upgrade to Sonatype Nexus Repository Manager version 3.71.0 or later, which addresses this vulnerability
• Review system logs and database access patterns for signs of prior exploitation

Patch Information

Sonatype has released version 3.71.0 of Nexus Repository Manager which addresses this vulnerability. Organizations should upgrade to this version or later as soon as possible. For detailed information about the fix and upgrade procedures, refer to the Sonatype Nexus Repository 3.71.0 Release Notes and the Sonatype Support Article.

Workarounds

• Disable the OrientDB binary listener by ensuring nexus.orient.binaryListenerEnabled is set to false or absent from configuration
• Implement network firewall rules to block external access to the OrientDB binary protocol port (default: 2424)
• Deploy network segmentation to isolate Nexus Repository Manager instances from untrusted network segments
• If the binary listener is required for operational reasons, restrict access at the network level to only authorized management hosts

# Configuration example - Disable the OrientDB binary listener
# Edit the nexus.properties file (typically located at $NEXUS_HOME/etc/nexus-default.properties or sonatype-work/nexus3/etc/nexus.properties)

# Ensure this line is set to false or remove it entirely
nexus.orient.binaryListenerEnabled=false

# Restart the Nexus service after making configuration changes
systemctl restart nexus