CVE-2026-11403CWE-331

CVE-2026-11403

High · published July 14, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00316 · 23.3th percentile
Weakness
CWE-331 · Insufficient Entropy
Published
2026-07-14T20:16Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.0.0, < 3.93.03.93.0
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/52347011450515/ · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 14 JUL 15:28Z
    Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation
    cvelistv5