Summary
CVE-2026-3329 is a missing authentication rate-limiting vulnerability (CWE-307: Improper Restriction of Excessive Authentication Attempts) in Sonatype Nexus Repository Manager, affecting all versions from 3.0.0 through 3.92.3. Because no lockout or throttling controls are enforced on authentication endpoints, a remote unauthenticated attacker can submit unlimited login requests to conduct brute-force or credential-stuffing attacks against user accounts. The vulnerability carries a CVSS 4.0 base score of 8.7 (High).
Technical details
- Root cause: Authentication endpoints in Nexus Repository Manager — covering both the web UI and REST API — lacked any mechanism to restrict or throttle excessive login attempts, a condition classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts).
- Trigger conditions: An attacker sends repeated, automated authentication requests to the login endpoint without triggering any rate limit, delay, or account lockout response.
- Attack vector: Fully network-accessible with no privileges required and no user interaction needed (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N); the attack can be carried out from any remote network location against any internet-exposed instance.
- Impact: Successful account takeover grants unauthorized access to the full contents of the Nexus repository — including proprietary software artifacts, build dependencies, Docker images, and credentials stored in proxy repository configurations. A compromised Nexus instance is a credible entry point for software supply-chain attacks.
Affected software
- Sonatype Nexus Repository Manager 3: versions 3.0.0 through 3.92.3 (all releases prior to 3.93.0)
Severity
- CVSS 4.0 Base Score: 8.7 (High)
- Vector string:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate – upgrade: Apply Sonatype Nexus Repository Manager 3.93.0, which introduces authentication attempt rate limiting. After three consecutive failed login attempts, subsequent requests to both the UI and API authentication endpoints are throttled with HTTP 429 responses and
Retry-Afterheaders. Rate-limiting behavior can be tuned via thenexus.auth.ratelimit.*configuration properties. - If immediate upgrade is not feasible: Enable the IP Allow List feature (available in Pro and Cloud editions) to restrict authentication endpoint access to trusted source IP ranges. Additionally, enforce network-level controls (firewall rules, reverse-proxy ACLs) to prevent unauthenticated internet access to Nexus login endpoints, particularly on the default port 8081.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

