CVE-2026-11403 — Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a t…
Published: 2026-07-14 · CVSS: 8.7 · CVSS 4.0
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7