Sonatype Nexus Repository: weak format-specific API key generation lets a remote attacker act as a targeted user

Impact

Nexus's format-specific API key realms - Docker Bearer Token, npm Bearer Token, NuGet API Key - generate keys in a way that lets a remote attacker gain repository access as a user who holds an active key for that realm. For an operator this is the container and package registry that feeds the whole fleet: an attacker with a deploy-capable user's effective rights can read private images and, depending on that user's privileges, push to repositories that GPU nodes pull from, which turns one registry account into a path onto every node that runs the affected tag. The record does not describe the generation weakness in detail and gives no exploitation-in-the-wild signal; it is only exploitable when one of those realms is enabled and the targeted user actually has a key issued.

Who can reach it

Remote and unauthenticated against the Nexus HTTP endpoint, per the CVSS vector (PR:N). Preconditions are on the server side: a format-specific API key realm must be enabled and the victim must have an active API key. Anyone who can reach the registry - in most fleets that is every node and every CI runner - is in position.

What to do

Upgrade Nexus Repository to 3.93.0, which carries the fix per the release notes, and restart the service - a short registry outage, not a fleet-wide maintenance window. Afterwards treat existing Docker/npm/NuGet bearer tokens as suspect: rotate or revoke them, since upgrading does not invalidate keys already minted. If the upgrade cannot be scheduled immediately, disabling the unused format-specific API key realms removes the precondition.

References

Related entries

• Kyverno: unchecked type assertion in shallow variable substitution panics the policy engineCVE-2026-122314 · Kyverno admission controller (variable-substitution engine, shallow `{{- var }}` substitution)High
• Kyverno: non-string attestation `type` field panics image verification, bypassing signature checksCVE-2026-122315 · Kyverno image verification (buildStatementMap attestation statement parsing)High
• Kyverno: In/NotIn operators panic on non-string JMESPath arrays, crashing admission controlCVE-2026-122319 · Kyverno policy engine (`In` / `NotIn` operator JMESPath value handling)High
• Kyverno: unbounded decompression of attestation predicate layers OOM-kills the admission controllerCVE-2026-122322 · Kyverno attestation verification (extractStatement gzip predicate layer decompression)High
• Kyverno: unbounded decompression of notary signature layers exhausts admission controller memoryCVE-2026-122323 · Kyverno notary verification (FetchSignatureBlob gzip signature layer decompression)High
• Kyverno: namespaced tenants can template generate rules to write resources into any namespaceCVE-2026-124441 · Kyverno background-controller (generate rule target templating)High