High severity · published Jul 14, 2026
CVE-2026-11403
Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NR
Nexus Repository Manager · Sonatype
3.0.0 before 3.93.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11403
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11403
Release Notes
https://help.sonatype.com/en/sonatype-nexus-repository-3-93-0-release-notes.html
Vendor Advisory
https://support.sonatype.com/hc/en-us/articles/52347011450515/
More from Nexus Repository Manager
9.8
CVE-2019-7238
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
9.8
CVE-2026-5189
Nexus Repository 3 - Hardcoded Credential in Internal Database Component
9.8
CVE-2019-9629
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials)
9.8
CVE-2017-17717
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature
8.8
CVE-2026-17600
Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation