EUVD-2026-43959
GHSA-jxph-5989-pgpj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires attacker-controlled upstream server (AC:H), low-privilege read access (PR:L), scope change to internal systems (S:C), with confidentiality as the primary impact (C:H) and no integrity or availability effect.
Primary rating from Vendor (Sonatype).
CVSS VectorVendor: Sonatype
Lifecycle Timeline
2DescriptionCVE.org
Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server - including an anonymous user, if anonymous access is enabled - could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.
AnalysisAI
SSRF protections in Sonatype Nexus Repository 3 are bypassed when proxy repository upstream servers return HTTP redirects, allowing those redirects to target internal network addresses or cloud metadata endpoints such as AWS IMDSv1. Any user with read access to an affected proxy repository - including anonymous users if anonymous access is enabled - can receive responses from internal infrastructure, potentially leaking cloud IAM credentials or other sensitive internal data. No public exploit or CISA KEV listing has been identified at time of analysis, but the condition relies on attacker-controlled or compromised upstream servers, making this a credible supply-chain-adjacent threat in enterprises relying on external upstream repositories.
Technical ContextAI
Nexus Repository 3 (CPE: cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:*) is a widely used enterprise artifact repository manager supporting Maven, npm, Docker, and other formats. It supports 'proxy repositories' that cache artifacts from remote upstream sources. CWE-918 (Server-Side Request Forgery) describes a class of vulnerability where a server-side component follows attacker-influenced URLs without adequate restriction. In this case, Nexus enforced SSRF protections on the initial request to the upstream server but failed to apply those same controls to HTTP redirect responses returned by the upstream. When an upstream server (attacker-controlled or compromised) responds with a 3xx redirect to an internal address - such as a cloud metadata endpoint (e.g., 169.254.169.254 for AWS IMDSv1) or an RFC-1918 address - Nexus would follow the redirect and return the internal response as repository content to the requesting user.
RemediationAI
Upgrade Sonatype Nexus Repository 3 to version 3.94.0 or later, which extends existing SSRF protections to cover HTTP redirect targets returned by upstream proxy servers. The vendor's official release notes confirming the fix are at https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html and the advisory is at https://support.sonatype.com/hc/en-us/articles/53165019641363/. For organizations unable to patch immediately, compensating controls include: restricting or disabling anonymous access to proxy repositories to raise the privilege bar for exploitation; auditing all configured proxy repository upstream URLs and limiting upstreams to known-trusted, organization-controlled servers; and applying network-level egress filtering on the Nexus host to block outbound requests to RFC-1918 ranges and cloud metadata endpoint IPs (169.254.169.254, fd00:ec2::254 for AWS; 169.254.169.254 for GCP/Azure). Note that egress filtering at the network layer may interfere with legitimate artifact resolution if internal upstreams are in use - validate before applying.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inj
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capabilit
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users hold
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today