CVE-2026-11403
Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation
- State
- Published
- Severity
- 8.7 High
- Published
- Jul 14, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jun 5, 2026
Description
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | Sonatype |
Weaknesses
- CWE-331 Insufficient entropy
Affected Products
| Product | Versions |
|---|---|
Nexus Repository ManagerSonatype |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.