Sonatype Nexus Repository 3.93.2 is now available.
Release 3.93.2 fixes an issue that prevented users with multi-action application privileges from correctly accessing authorized resources.
3.93.1 fixed multiple Ansible Galaxy and PyPI bugs impacting versions 3.91.x through 3.93.0.
3.93.0 also introduces support for Go hosted and group repositories as well as Ansible and Alpine formats. It also refreshes the artifact upload UI, adds multiple security improvements, and gives Firewall the ability to renew expired waivers.
After upgrading Nexus from version 3.86 to 3.93.1, many of my users started encountering the following error when pulling Docker images:
“pull access denied, repository does not exist or may require authorization: authorization failed: no basic auth credentials”
If they run docker login, the error disappears.
Does your fix address this specific issue?
NEXUS-53512 – Users with multi-action application privileges can now access authorized resources correctly, preventing incorrect 403 responses during permission checks.
Hey @itperfecto - apologies for my very delayed response!
Short answer, no, NEXUS-53512 does not fix that issue; however, the issue should be fixed in 3.93 by NEXUS-52659. Some longer explanation courtesy of our internal AI below:
In 3.91, a behavior change was introduced where anonymous pulls through a Docker group repository required every member repository to also have “Allow Anonymous Docker Pulls” enabled. If any member repository had anonymous pull disabled, the group would return a misleading 404 (instead of a proper 401 challenge), causing Docker clients to never retry with credentials — resulting in the "no basic auth credentials" error. This affected both anonymous pull scenarios and authenticated pulls via containerd-based clients.
Under the NEXUS-52659 fix, Anonymous pulls through a Docker group repository are governed by the group repository’s Allow Anonymous Docker Pulls setting — member repositories do not need to have it enabled individually.
What to Check on 3.93.1
Docker group repository — Verify that Allow Anonymous Docker Pulls is enabled on the group repository itself.
Global anonymous access — Confirm it is enabled under Security → Anonymous Access.
Docker Bearer Token Realm — Ensure it is active under Security → Realms.
User Tokens setting — If “Require User Tokens for Repository Authentication” is enabled (under Security → User Tokens), cached Docker bearer tokens from before the upgrade may be invalid. Users would need to docker logout and docker login again with user token credentials, or this setting can be disabled to make user tokens optional.