CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3

CVE-2026-5189 is a hard-coded credential flaw in an internal Nexus Repository Manager database component affecting Sonatype Nexus Repository Manager 3.0.0 through 3.70.5. If an attacker can reach the OrientDB binary listener, they can authenticate with the embedded credential, gain read/write access to the internal database, and from there execute OS commands as the Nexus process user. The crucial catch is deployment reality: Sonatype says exploitation requires nexus.orient.binaryListenerEnabled=true, and that listener is *not enabled by default* in standalone installs.

In practice, this is not a blanket internet-RCE across all Nexus 3 servers. The vendor/CNA now publishes a CVSS v4 9.2 critical baseline, but that score overstates fleet-wide exposure because the vulnerable path only exists in explicitly enabled binary-listener deployments or legacy HA-C mode with nexus.clustered=true. That narrowing friction keeps this out of CRITICAL for most enterprises, but it still lands at HIGH because Nexus sits in the software supply chain and compromise can poison builds, secrets, and artifacts.

Why this verdict

• Major downward pressure: non-default prerequisite — the vulnerable OrientDB binary listener is not enabled in default standalone deployments, so this is not a broad all-host Nexus 3 emergency.
• Additional downward pressure: legacy architecture bias — Sonatype says legacy HA-C mode with nexus.clustered=true is affected, while the current supported HA architecture is not. That implies a meaningful chunk of modern enterprise deployments are outside the blast radius.
• Upward pressure: supply-chain position — if exploited, the target is not a random app server; it is the artifact repository that feeds builds and deployments. Even execution as the Nexus process user can have outsized organizational impact.

Why not higher?

This misses CRITICAL because exploitation depends on a specific deployment state that many organizations simply do not have: the binary listener must be enabled and reachable. There is also no reviewed evidence of active exploitation, no KEV listing, and no public commodity PoC located, all of which reduce immediate fleet-wide emergency pressure.

Why not lower?

This stays above MEDIUM because the technical outcome is still severe: unauthenticated network access can become database compromise and OS command execution. And unlike a low-value internal service, Nexus often sits on the software supply chain path, so one successful hit can cascade into artifact tampering, secret exposure, and downstream compromise.

1. Disable the binary listener — Remove nexus.orient.binaryListenerEnabled=true anywhere it is not strictly required. This directly breaks the exploit chain and, for a HIGH verdict, should be completed within 30 days.
2. Block backend listener reachability — Restrict the OrientDB listener to localhost or a tightly controlled management segment using host firewall and network ACLs; do not rely on HTTP-layer controls. Treat this as the fastest compensating control and deploy it within 30 days.
3. Eliminate legacy HA-C exposure — If you still run legacy HA-C with nexus.clustered=true, prioritize moving off that architecture because Sonatype explicitly identifies it as affected. For this HIGH verdict, put that migration path in motion within 30 days even if full remediation takes longer.
4. Increase host telemetry on Nexus — Ensure EDR, process creation logging, and repository audit retention are enabled on Nexus servers so you can catch command execution and repository tampering if someone reaches the host before patching. Deploy this coverage within 30 days on all exposed instances.

Run this on the target Nexus host or from an admin workstation with filesystem access to the Nexus install and data directories. Invoke it as python3 check_cve_2026_5189.py --app-dir /opt/sonatype/nexus --data-dir /nexus-data (Windows example: py check_cve_2026_5189.py --app-dir C:\Sonatype\Nexus --data-dir C:\nexus-data). No root/admin is required if you can read the Nexus installation and nexus.properties file.

#!/usr/bin/env python3
# Check Sonatype Nexus Repository Manager for CVE-2026-5189 exposure
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import re
import sys
from pathlib import Path

VERSION_RE = re.compile(r'nexus-base-(\d+\.\d+\.\d+(?:-\d+)?)\.jar$')
PROPS_RE = re.compile(r'^\s*([^#][^=\s]+)\s*=\s*(.*?)\s*$')


def parse_args():
    p = argparse.ArgumentParser(description='Check CVE-2026-5189 exposure for Sonatype Nexus Repository Manager')
    p.add_argument('--app-dir', required=True, help='Nexus application/install directory')
    p.add_argument('--data-dir', required=True, help='Nexus data directory containing etc/nexus.properties')
    return p.parse_args()


def parse_version(ver):
    # Supports formats like 3.70.5 or 3.70.5-01
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)(?:-(\d+))?$', ver)
    if not m:
        return None
    major, minor, patch, build = m.groups()
    return (int(major), int(minor), int(patch), int(build or 0))


def version_leq(v1, v2):
    return v1 <= v2


def version_gte(v1, v2):
    return v1 >= v2


def find_version(app_dir: Path):
    candidates = []
    for root, _, files in os.walk(app_dir):
        for name in files:
            m = VERSION_RE.search(name)
            if m:
                ver = m.group(1)
                pv = parse_version(ver)
                if pv:
                    candidates.append((pv, ver, str(Path(root) / name)))
    if not candidates:
        return None, None
    candidates.sort(reverse=True)
    return candidates[0][1], candidates[0][2]


def load_properties(props_path: Path):
    props = {}
    if not props_path.exists():
        return None
    try:
        with props_path.open('r', encoding='utf-8', errors='ignore') as f:
            for line in f:
                m = PROPS_RE.match(line)
                if m:
                    k, v = m.groups()
                    props[k.strip()] = v.strip()
    except Exception:
        return None
    return props


def truthy(val):
    return str(val).strip().lower() in ('true', '1', 'yes', 'on')


def main():
    args = parse_args()
    app_dir = Path(args.app_dir)
    data_dir = Path(args.data_dir)
    props_path = data_dir / 'etc' / 'nexus.properties'

    version_str, version_src = find_version(app_dir)
    props = load_properties(props_path)

    if version_str is None:
        print('UNKNOWN: could not determine Nexus version from app directory')
        sys.exit(2)

    pv = parse_version(version_str)
    if pv is None:
        print(f'UNKNOWN: unrecognized version format: {version_str}')
        sys.exit(2)

    vulnerable_max = parse_version('3.70.5')
    fixed_min = parse_version('3.71.0')

    if props is None:
        print(f'UNKNOWN: could not read properties file: {props_path}')
        sys.exit(2)

    binary_listener = truthy(props.get('nexus.orient.binaryListenerEnabled', 'false'))
    legacy_clustered = truthy(props.get('nexus.clustered', 'false'))

    # Advisory says default standalone/current supported HA are not affected.
    # Vulnerable if version <= 3.70.5 and vulnerable listener path is enabled.
    if version_leq(pv, vulnerable_max) and (binary_listener or legacy_clustered):
        reason = []
        if binary_listener:
            reason.append('nexus.orient.binaryListenerEnabled=true')
        if legacy_clustered:
            reason.append('nexus.clustered=true (legacy HA-C indicator)')
        print(f'VULNERABLE: Nexus {version_str} at {version_src}; trigger(s): ' + ', '.join(reason))
        sys.exit(1)

    if version_gte(pv, fixed_min):
        print(f'PATCHED: Nexus {version_str} at {version_src} is at or above 3.71.0')
        sys.exit(0)

    # Older vulnerable-version software but config does not expose the vulnerable path.
    print(f'PATCHED: Nexus {version_str} is in affected version range, but vulnerable listener settings were not found in {props_path}')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Sonatype advisory for CVE-2026-5189
2. NVD record for CVE-2026-5189
3. Sonatype Nexus Repository 3.71.0 release notes
4. Sonatype upgrade guidance for 3.71.0 and beyond
5. CISA Known Exploited Vulnerabilities catalog
6. FIRST EPSS overview
7. Sonatype Nexus Repository product page
8. MITRE CWE-798 definition