CVE-2026-3329: Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts

Synopsis

Improper restriction of authentication attempts (credential brute-forcing) in Sonatype Nexus Repository Manager allows a remote, unauthenticated attacker to systematically guess user account credentials against the authentication endpoints. No prior account or special network position is required; the attacker only needs to reach the service over the network. Successful exploitation gives the attacker the ability to recover valid credentials and gain unauthorized access to user accounts, disclosing the data and permissions those accounts can reach. A patched-image rebuild at version 3.93.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Nexus Repository Manager authentication endpoint over the network; no local or physical access is needed, but the service must be exposed.

• AuthenticationNot required

  No account or credentials of any kind are required to begin the attack; the attacker targets the login endpoint from an unauthenticated position.

• Victim interactionNot required

  No user action is needed; the attack is carried out entirely by the attacker against the service without any social-engineering step.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions, specific memory layout, or environmental prerequisites required.

Blast Radius

• A successful attacker recovers plaintext or usable credentials for one or more Nexus user accounts.
• With valid credentials in hand, the attacker can authenticate as the compromised user and read any artifacts, repositories, or secrets that account can access.
• Account compromise may expose API tokens, build secrets, or private package contents stored in or accessible through the repository manager.