EUVD-2026-43737
GHSA-7364-vc59-2428
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF requiring Capability Admin privilege (PR:H); scope changes to internal systems justifying S:C with limited C:L and I:L against subsequent resources.
Primary rating from Vendor (Sonatype).
CVSS VectorVendor: Sonatype
Lifecycle Timeline
1DescriptionCVE.org
Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.
AnalysisAI
Server-Side Request Forgery in Sonatype Nexus Repository 3 allows any holder of the Capability Administration permission to redirect the server's outbound HTTP requests to arbitrary internal network addresses by supplying a crafted URL in the Webhook Global capability configuration, enabling probing of internal infrastructure. The vulnerability is patched in version 3.94.0 per Sonatype's release notes. No public exploit code exists and the vulnerability is not in CISA KEV, but risk escalates materially on instances where the anonymous role has been granted the Capability Administration permission, as this exposes the SSRF to unauthenticated actors without any configuration changes beyond that role assignment.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) describes exactly this flaw class: the application accepts a user-supplied URL and issues an outbound HTTP request without validating the destination against an allowlist or blocking requests to internal address ranges. In Nexus Repository 3 (CPE: cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:*), the Webhook Global capability is a built-in feature that fires outbound HTTP calls to a configured endpoint in response to repository lifecycle events such as asset or component updates. Because the URL field accepts any scheme and host - including RFC-1918 addresses, loopback, link-local ranges such as 169.254.169.254 (cloud metadata), and internal hostnames - the Nexus process is turned into a server-side proxy. Depending on whether the webhook framework surfaces response bodies or error details, the attacker may be able to enumerate open ports, read data from unauthenticated internal services, or interact with internal APIs that trust requests originating from the Nexus host.
RemediationAI
Upgrade Sonatype Nexus Repository 3 to version 3.94.0 or later, which introduces destination URL validation for the Webhook Global capability per the vendor release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html and security advisory at https://support.sonatype.com/hc/en-us/articles/53158843564179/. If immediate patching is not feasible, perform two compensating actions: first, audit all current Webhook Global capability configurations and remove or disable any webhooks pointing to untrusted or internal destinations; second, and most critically, verify that the anonymous role in Nexus has not been granted the Capability Administration permission - remove it if present, as this is the condition that elevates the vulnerability to unauthenticated exploitation. As a network-layer control, configure egress firewall rules on the Nexus host to block outbound HTTP/HTTPS to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.1/8), and link-local addresses (169.254.0.0/16); note this may disrupt legitimate internal webhook integrations and should be validated against your architecture before deployment.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inj
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capabilit
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users hold
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today