# CVE-2026-113370: Sonatype Nexus Repository 3 SQL injection in Reindex Search Tables task

Source: https://junglewise.ai/threats/cve-2026-113370-sonatype-nexus-repository-3-contains-a-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-113370 · Severity: info · Published 2026-11-04

Sonatype Nexus Repository 3 is an artifact repository that manages software libraries and dependencies for enterprises. A SQL injection flaw in an optional task allows users with task-creation privileges to inject malicious SQL commands that can modify data stored in the Nexus database, potentially corrupting repository metadata or exposing sensitive information.

Technologies: [Sonatype Nexus Repository 3](https://junglewise.ai/threats/technologies/nexus-repository-3). Vendors: [Sonatype](https://junglewise.ai/threats/vendors/sonatype).

## Quick answers

**Is CVE-2026-113370 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113370 being exploited in the wild.

**How severe is CVE-2026-113370?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Sonatype Nexus Repository 3.

**Is there a fix for CVE-2026-113370?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-113370 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-113370?** Check whether you run Sonatype Nexus Repository 3. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the "Reindex Search Tables By Pattern" task, which is disabled by default but can be enabled via the nexus.reindex.search.by.pattern.visible configuration setting. A user with the nexus:tasks:create privilege can supply a crafted filter condition that the database executes as SQL code, allowing arbitrary database manipulation. This is a SQL injection vulnerability requiring authenticated access and a non-default configuration.

## Affected products

- Sonatype Nexus Repository 3

## Timeline

- 2026-11-04: disclosed

## References

- [https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html](https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html)
- [https://support.sonatype.com/hc/en-us/articles/56603207226131/](https://support.sonatype.com/hc/en-us/articles/56603207226131/)

## Related threats

- [Sonatype Nexus Repository 3 authorization bypass in Rut Auth capability](https://junglewise.ai/threats/cve-2026-113374-sonatype-nexus-repository-3-does-not-require-realm)
- [Sonatype Nexus Repository 3 YUM private key disclosure to read-only accounts](https://junglewise.ai/threats/cve-2026-113372-sonatype-nexus-repository-3-returns-the-private-signing-key-of-a)
- [Sonatype Nexus Repository 3 signing passphrase disclosure in REST endpoint](https://junglewise.ai/threats/cve-2026-113371-sonatype-nexus-repository-3-returns-the-signing-passphrase-of-an)
- [Sonatype Nexus Repository stored XSS in OCI manifest artifact type](https://junglewise.ai/threats/cve-2026-113369-sonatype-nexus-repository-3-allows-a-user-account-that-can-push)
- [Sonatype Nexus Repository 3 privilege escalation via unauthorized repository access](https://junglewise.ai/threats/cve-2026-113368-sonatype-nexus-repository-3-does-not-check-that-a-user-account)