Skip to main content

Nexus Repository CVE-2026-7494

| EUVDEUVD-2026-43744 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-07-14 Sonatype GHSA-jpvp-vqx9-22qg
SSRF Nexus Repository
5.3
CVSS 4.0 · Vendor: Sonatype
Share

Severity by source

Vendor (Sonatype) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.0 MEDIUM

Network-reachable endpoint exploitable by low-privilege users; scope change to subsequent systems captures internal SSRF pivot; no confidentiality or integrity impact on the Nexus host itself.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 16:35 vuln.today
CVE Published
Jul 14, 2026 - 15:46 cve.org
MEDIUM 5.3

DescriptionCVE.org

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.

AnalysisAI

Server-Side Request Forgery in Sonatype Nexus Repository 3 exposes internal network infrastructure to authenticated users holding the nexus:ssl-truststore:read permission, who can weaponize the SSL Certificate Retrieval endpoint to force the server to initiate outbound TCP connections to arbitrary hosts - including cloud metadata services, internal APIs, and otherwise firewalled systems. All versions from 3.0.0 up to (but not including) 3.94.0 are affected, and a vendor-released patch is available. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain Nexus account with nexus:ssl-truststore:read permission
Delivery
Craft request to SSL Certificate Retrieval endpoint with internal target address
Exploit
Server initiates outbound connection to internal host
Execution
Receive response or connection metadata
Impact
Enumerate internal services or harvest cloud metadata credentials
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated Nexus session with the nexus:ssl-truststore:read permission explicitly granted - this is not a default permission for all users and is typically restricted to administrators or security operators managing the trust store. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms this is network-exploitable with low complexity and no attack prerequisites beyond holding the nexus:ssl-truststore:read permission - substantially limiting the exposed population to users who have been explicitly granted that role. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a Nexus account holding the nexus:ssl-truststore:read permission submits a crafted request to the SSL Certificate Retrieval endpoint targeting an internal host - for example, the AWS EC2 instance metadata service at 169.254.169.254 or an internal Kubernetes API server. The Nexus server initiates a TCP connection and returns connection results or certificate data from the internal target, allowing the attacker to enumerate internal services, harvest cloud credentials from metadata endpoints, or map the internal network without needing direct network access to those hosts. …
Remediation Upgrade Sonatype Nexus Repository to version 3.94.0 or later, as documented in the official release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nexus Repository

View all
CVE-2026-5189 CRITICAL
9.2 Apr 15

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unau
CVE-2026-10748 HIGH
8.6 Jun 16

Arbitrary OS command execution in Sonatype Nexus Repository 3 versions prior to 3.92.0 allows authenticated users holdin
CVE-2026-7308 MEDIUM
5.1 May 11

Stored cross-site scripting (XSS) in Sonatype Nexus Repository 3.6.0 through 3.91.x allows authenticated users with uplo
CVE-2026-3048 MEDIUM
5.1 May 11

An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2023-48022 CRITICAL POC
9.8
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8
CVE-2026-15409 CRITICAL POC
10.0
CVE-2024-54385 HIGH POC
7.2
CVE-2022-45835 MEDIUM POC
5.8
CVE-2024-54330 HIGH POC
7.2
CVE-2026-20230 HIGH POC
8.6

Share

CVE-2026-7494 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy