# CVE-2026-5189: CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an…

Source: https://junglewise.ai/threats/cve-2026-5189-cwe-798-use-of-hard-coded-credentials-in-sonatype-nexus-repository  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-15  
License: CC BY 4.0 with a link back

CVE-2026-5189 · Severity: critical · CVSS 9.8 · Published 2026-04-15

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

Technologies: [Sonatype Nexus Repository Manager](https://junglewise.ai/threats/technologies/nexus-repository-manager). Vendors: [Sonatype](https://junglewise.ai/threats/vendors/sonatype).

## Quick answers

**Is CVE-2026-5189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5189 being exploited in the wild.

**How severe is CVE-2026-5189?** Critical severity, with a CVSS score of 9.8, published 15 April 2026.

**Which products and versions are affected?** Sonatype Nexus Repository Manager. The advisory does not name versions.

**Is there a fix for CVE-2026-5189?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-5189?** Check whether you run Sonatype Nexus Repository Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Sonatype Nexus Repository Manager

## Related threats

- [Sonatype Nexus Repository authorization bypass in blobstore management](https://junglewise.ai/threats/cve-2026-77125-sonatype-nexus-repository-authorization-bypass-in-blobstore)
- [Sonatype Nexus Repository privilege escalation in script execution](https://junglewise.ai/threats/cve-2026-77124-sonatype-nexus-repository-privilege-escalation-in-script)
- [Sonatype Nexus Repository 3 sensitive information disclosure in capability API](https://junglewise.ai/threats/cve-2026-77123-sonatype-nexus-repository-3-sensitive-information-disclosure-in)
- [Sonatype Nexus Repository authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-77122-sonatype-nexus-repository-authorization-bypass-in-rest-api)
- [Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the…](https://junglewise.ai/threats/cve-2026-17603-nexus-repository-3-did-not-sufficiently-restrict-which-hikaricp)