Nexus Repository 3 CVE-2026-77122

Exploitation requires the requesting account to hold at minimum a read or browse permission on at least one group repository in the Nexus instance, and the targeted member repository must belong to that group. The attacker must also know or enumerate the name of the member repository (repository names are often predictable from naming conventions). In the unauthenticated path - which is installation-dependent, not a default - the anonymous user must have been explicitly granted browse or read rights on a group repository through the site's role and permission configuration. No other non-default configuration is required; the flaw exists in standard group-repository deployments. Exploitation is limited to the repository metadata endpoint only and does not grant access to stored artifacts, administrative functions, or write operations.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:L and no integrity or availability impact) is broadly accurate: the vulnerability is network-reachable, low-complexity to exploit, requires at least low-level authenticated access in typical deployments, and produces only a modest confidentiality leak. The practical risk is bounded by what the endpoint actually reveals - repository configuration metadata rather than artifact content - but the disclosure of internal proxy remote URLs can be operationally meaningful: it may expose air-gapped mirror hostnames, internal PKI or toolchain infrastructure URLs, or topology information useful for downstream attack planning. The anonymous user carve-out is the most significant risk amplifier: in installations where the anonymous account has been granted browse permissions on group repositories, this flaw becomes effectively unauthenticated, and even a mid-sized municipal IT team in walbrzych that enables anonymous Nexus access for convenience would be exposing proxy metadata to any network-reachable party. EPSS data was not provided; KEV status is absent, indicating no confirmed active exploitation. No POC is publicly documented, and the narrow impact (metadata-only, no artifacts, no write access) makes weaponization into a standalone high-impact attack unlikely without chaining to other reconnaissance.

An attacker with a low-privilege Nexus account (or no account at all if anonymous access is configured with group-browse permissions) sends a crafted HTTP GET request to /service/rest/v1/repositories/{memberRepoName} targeting a member repository name they have enumerated or guessed. The API returns the full metadata JSON for that member repository, including its configured remote URL for proxy repositories. The attacker extracts internal hostnames - such as an air-gapped PyPI mirror at an internal address - and uses this topology information to plan further lateral movement or supply-chain-targeted attacks.