EUVD-2026-54512
GHSA-prvc-9rv9-3f72
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires high admin privilege; SSRF causes a scope change enabling low-confidentiality enumeration of internal subsequent systems with no integrity or availability impact.
Primary rating from Vendor (Sonatype).
CVSS VectorVendor: Sonatype
Lifecycle Timeline
2DescriptionCVE.org
Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server's response could be used to infer whether internal hosts and ports are reachable. This issue affects Nexus Repository 3 CE/Pro versions up to and including 3.94.1, and is fixed in version 3.95.0.
AnalysisAI
The email configuration verification endpoint in Sonatype Nexus Repository 3 (CE and Pro editions through 3.94.1) allows authenticated users holding the nexus:settings:update permission to submit arbitrary host and port values, causing the server to probe internal or restricted network addresses via Server-Side Request Forgery. Differences in server responses - connection timing, error codes, and success signals - act as a side channel revealing which internal hosts and ports are reachable from the Nexus server, enabling internal network enumeration. No public exploit has been identified at time of analysis, and vendor-released patch version 3.95.0 resolves the issue.
Technical ContextAI
The vulnerability resides in the email test/verification feature of Sonatype Nexus Repository 3, covering both Community and Professional editions (CPE: cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:*). CWE-918 (Server-Side Request Forgery) identifies the root cause: user-supplied host and port values are passed to an outbound network connection routine without validating or allowlisting permitted destinations. Because the application does not constrain where the email verification connection can reach, the server is coerced into acting as a network proxy. The SSRF is oracle-based - the attacker does not receive response content from the probed host, but rather infers reachability from behavioral differences (timeouts vs. refused connections vs. successful handshakes), a well-understood SSRF variant applicable to internal port-scanning and service discovery.
RemediationAI
The primary fix is to upgrade Nexus Repository 3 to version 3.95.0 or later, confirmed as the patched release by Sonatype's official release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html and security advisory at https://support.sonatype.com/hc/en-us/articles/53876968087955/. If immediate upgrade is not feasible, restrict the nexus:settings:update permission to the absolute minimum set of trusted administrator accounts, reducing the set of users who can invoke the vulnerable email verification endpoint - note this does not eliminate the vulnerability but narrows the attacker population. Additionally, implement host-based or perimeter egress filtering on the Nexus server to block outbound TCP connections to internal RFC 1918 ranges and other restricted network segments; this removes the reconnaissance value of the SSRF even if exploited, though it does not patch the underlying flaw and may interfere with legitimate email server connectivity if the SMTP target resides on an internal address. Review current permission assignments to identify any non-administrator accounts holding nexus:settings:update before applying the patch.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inj
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capabilit
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users hold
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today