Skip to main content

Nexus Repository 3 CVE-2026-14646

| EUVDEUVD-2026-43959 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-07-14 Sonatype GHSA-jxph-5989-pgpj
SSRF Nexus Repository 3
4.9
CVSS 4.0 · Vendor: Sonatype
Share

Severity by source

Vendor (Sonatype) PRIMARY
4.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Requires attacker-controlled upstream server (AC:H), low-privilege read access (PR:L), scope change to internal systems (S:C), with confidentiality as the primary impact (C:H) and no integrity or availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 21:50 vuln.today
CVE Published
Jul 14, 2026 - 16:49 cve.org
MEDIUM 4.9

DescriptionCVE.org

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server - including an anonymous user, if anonymous access is enabled - could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

AnalysisAI

SSRF protections in Sonatype Nexus Repository 3 are bypassed when proxy repository upstream servers return HTTP redirects, allowing those redirects to target internal network addresses or cloud metadata endpoints such as AWS IMDSv1. Any user with read access to an affected proxy repository - including anonymous users if anonymous access is enabled - can receive responses from internal infrastructure, potentially leaking cloud IAM credentials or other sensitive internal data. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker controls or compromises upstream repository server
Delivery
Configure upstream to return HTTP 3xx redirect to internal/metadata endpoint
Exploit
Low-privilege or anonymous user requests artifact via Nexus proxy repository
Execution
Nexus follows redirect without SSRF validation
Persist
Internal resource (e.g., cloud IAM credentials) returned as repository response
Impact
Attacker retrieves sensitive credentials
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two concurrent conditions: first, the target proxy repository's upstream server must be under attacker control or have been compromised, as the SSRF redirect must originate from the upstream response - a Nexus instance pointing exclusively to trusted, internal-only upstreams is not exploitable via this path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 4.0 score of 4.9 (Medium) reflects several limiting factors: AT:P indicates that a specific attack requirement is present - namely, the upstream server must be attacker-controlled or compromised - and PR:L indicates the user must have at least read access to the proxy repository (though anonymous access can satisfy this if enabled). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who controls or has compromised an upstream repository server (e.g., a public npm or Maven mirror) configures it to respond to artifact requests with an HTTP 302 redirect pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/. A developer or CI pipeline with read access to the Nexus proxy repository requests a package through the proxy; Nexus follows the redirect without applying SSRF controls, fetches the cloud metadata response, and returns it as artifact content to the requesting client - exposing live IAM credentials. …
Remediation Upgrade Sonatype Nexus Repository 3 to version 3.94.0 or later, which extends existing SSRF protections to cover HTTP redirect targets returned by upstream proxy servers. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nexus Repository 3

View all
CVE-2026-14504 HIGH
8.2 Jul 14

Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
CVE-2026-14645 MEDIUM
5.1 Jul 14

Server-Side Request Forgery in Sonatype Nexus Repository 3 allows any holder of the Capability Administration permission

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2023-48022 CRITICAL POC
9.8
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8
CVE-2026-15409 CRITICAL POC
10.0
CVE-2024-54385 HIGH POC
7.2
CVE-2022-45835 MEDIUM POC
5.8
CVE-2024-54330 HIGH POC
7.2
CVE-2026-20230 HIGH POC
8.6

Share

CVE-2026-14646 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy