CVE-2026-5189: Hard-Coded Credentials in Sonatype Nexus

CVE-2026-5189 is a hard-coded credentials flaw (CWE-798) in Sonatype Nexus Repository Manager 3.0.0 through 3.70.5, scored 9.8 critical. It needs the non-default binary listener option enabled. Upgrade past 3.70.5 and confirm that the setting is not switched on in any of your instances.

What's affected

Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5, per the CVE record. Exploitation requires the non-default setting nexus.orient.binaryListenerEnabled=true.

The record links the Nexus Repository 3.71.0 release notes and a Sonatype support article. The pages did not render in my fetch, so I could not read the fixed version from them. Since the affected range ends at 3.70.5, 3.71.0 or later is the version to aim for, but check Sonatype's advisory for the confirmed fixed release.

The record says an unauthenticated attacker with network access could read and write the internal database and run operating system commands as the Nexus process user.

How to check if you're exposed

First read the version in the Nexus admin interface, or in the sonatype-work directory of your install. Then check the setting. Look in the properties file of your data directory:

grep -rn "binaryListenerEnabled" $NEXUS_DATA/etc/ $NEXUS_HOME/etc/ 2>/dev/null

Also look at environment variables and JVM arguments in your service definition, because the setting can come from there. If the setting is absent or false, the condition in the record is not met. For containers, check the NEXUS_* variables and any mounted properties file.

You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.

What to do now

1. List Nexus Repository instances and their versions, including old ones used by single teams.
2. Check each one for nexus.orient.binaryListenerEnabled=true, in files, environment and JVM arguments.
3. Remove the setting, or set it to false, if you do not need it.
4. Upgrade to a version after 3.70.5, after reading Sonatype's advisory for the confirmed fixed release.
5. Restrict network access to the repository manager to the people and build systems that need it.
6. If the listener was on and reachable, treat stored credentials and artifacts as potentially exposed and review them.

Why it matters

Hard-coded credentials (CWE-798) are secrets baked into software, the same in every installation. Anyone who learns them can use them against any instance that exposes the interface they protect. They cannot be rotated by customers, which is what makes them so costly.

The record limits the problem to installations where the binary listener for the internal database is enabled, which is not the default. That limit lowers the real exposure a great deal, but repository managers hold build outputs and credentials, so a compromise reaches into software delivery.

The record does not report exploitation in the wild, and the CVE is not in the CISA KEV catalog. Review of non-default settings is the cheapest control you have against bugs like this one.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Sonatype Nexus Repository 3.71.0 release notes (linked from the record; page did not render when fetched)
• Sonatype support article

Last reviewed: 19 October 2026.