Nexus Repository 3 CVE-2026-14646

Exploitation requires two concurrent conditions: first, the target proxy repository's upstream server must be under attacker control or have been compromised, as the SSRF redirect must originate from the upstream response - a Nexus instance pointing exclusively to trusted, internal-only upstreams is not exploitable via this path. Second, the attacker must be able to trigger a request through the affected proxy repository, which requires either a user account with read access to the proxy repository (PR:L per CVSS) or, where anonymous access is enabled, no authentication at all. Exploitation is further limited to cloud-hosted or network-adjacent Nexus deployments where the Nexus server can reach cloud metadata endpoints (169.254.169.254) or internal network addresses from its egress; on-premises deployments with full network egress filtering to RFC-1918 ranges reduce but may not eliminate impact. No special operating system configuration or non-default product feature is required beyond a configured proxy repository pointing to an external or attacker-controlled upstream.

The vendor-assigned CVSS 4.0 score of 4.9 (Medium) reflects several limiting factors: AT:P indicates that a specific attack requirement is present - namely, the upstream server must be attacker-controlled or compromised - and PR:L indicates the user must have at least read access to the proxy repository (though anonymous access can satisfy this if enabled). The CVSS 4.0 vector records SC:N/SI:H/SA:N for subsequent system impact, which is inconsistent with the description's emphasis on information disclosure (cloud IAM credentials). The most realistic primary impact is confidentiality, not integrity; this discrepancy should be verified against the vendor's scoring rationale. No KEV listing and no known public POC exist at time of analysis, so real-world exploitation probability is currently low. However, the scenario is credible in cloud-native environments relying on public or shared upstream registries: compromising or substituting an upstream repository (a supply-chain attack vector) would give an attacker a reliable path to harvest cloud IAM credentials from any Nexus user fetching artifacts through the affected proxy. Organizations using proxy repositories backed by third-party or public upstreams and running in cloud environments with accessible metadata services face meaningful risk despite the moderate CVSS score.

An attacker who controls or has compromised an upstream repository server (e.g., a public npm or Maven mirror) configures it to respond to artifact requests with an HTTP 302 redirect pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/. A developer or CI pipeline with read access to the Nexus proxy repository requests a package through the proxy; Nexus follows the redirect without applying SSRF controls, fetches the cloud metadata response, and returns it as artifact content to the requesting client - exposing live IAM credentials. No public POC exists at time of analysis, but the technique mirrors well-documented SSRF-via-redirect patterns used in other repository manager attacks.