Nexus Repository 3 CVE-2026-14645

Exploitation requires the Capability Administration permission in Nexus Repository 3, which is a privileged role not granted by default to ordinary users. Under a correctly hardened deployment this limits exploitation to authenticated administrators. However, the CVE description explicitly states that if the Nexus anonymous role has been granted the Capability Administration permission - a non-default but valid role-assignment configuration - unauthenticated exploitation is possible, since permission is role-based and independent of session authentication state. The vulnerability is exercised specifically through the Webhook Global capability URL configuration field; the webhook must be set to a malicious URL and then triggered by a qualifying Nexus lifecycle event. Network-level access to the Nexus web interface is required. Exploitation is NOT possible without the Capability Administration permission being in scope, and NOT possible if no Webhook Global capability is defined or triggerable.

The CVSS 4.0 score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N accurately represents baseline risk when the instance is correctly hardened: exploitation requires the Capability Administration role, a non-trivial privilege. The subsequent-system impact metrics (SC:L/SI:L) capture the real exposure - internal network probing and unsolicited interactions with internal services - rather than direct impact on the Nexus instance itself. The critical risk nuance is the CVE's explicit callout that the anonymous role can be granted this permission, collapsing PR:H to PR:N without a separate vulnerability; defenders must therefore treat their anonymous role configuration as a key variable. There is no CISA KEV listing and no public exploit code identified at time of analysis, so opportunistic mass exploitation is unlikely at present. The vulnerability is not a candidate for remote code execution or direct data exfiltration from Nexus, and impact is bounded by the Nexus server's network reach and whatever internal services respond to unauthenticated HTTP requests. In cloud-hosted deployments, the IMDS endpoint (169.254.169.254 or the IMDSv2 equivalent) represents the highest-value internal target.

An attacker with the Capability Administration role - or operating anonymously on an instance where the anonymous role has been granted that permission - navigates to the Nexus administration UI, opens the Webhook Global capability configuration, and sets the webhook URL to an internal address such as http://169.254.169.254/latest/meta-data/ or http://internal-jenkins:8080/api/json. The next qualifying repository event causes the Nexus server to issue an HTTP GET to that address; depending on the webhook framework's error reporting, the attacker may observe the response content, enumerate open ports, or interact with internal services that trust the Nexus host. No public exploit code has been identified, and the attack requires no technical tooling beyond access to the Nexus UI.