Nexus Repository 3 CVE-2026-77123

Exploitation requires an authenticated Nexus Repository 3 session with an account explicitly granted the nexus:capabilities:read privilege; accounts without this specific privilege cannot access the capability read API. At least one webhook capability must be configured with a shared secret for there to be any sensitive data to disclose - instances with no webhook secrets configured are unaffected by the confidentiality impact. The Nexus API must be network-reachable by the attacker (AV:N, standard for exposed repository managers). AT:P in the CVSS 4.0 vector explicitly acknowledges the privilege precondition as a specific attack requirement. Limiting factors: authentication and a non-default privilege grant are required; this is not a zero-interaction or unauthenticated path; and downstream impact depends on whether webhook receivers use the secret for validation.

The CVSS 4.0 score of 6.0 (Medium) with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H correctly captures the attack profile: network-reachable, low-complexity, but gated behind a specific authenticated privilege (nexus:capabilities:read) rather than being fully unauthenticated. Real-world risk is moderate-to-meaningful in enterprise environments where Nexus credentials are distributed to service accounts, developers, or CI/CD agents with broad read permissions, as the privilege required is not administrative and may be widely granted. The confidentiality impact is rated High because the exposed secret is a cryptographic signing key, not merely configuration metadata - its disclosure undermines the integrity assurance of every downstream webhook receiver relying on it. No EPSS data was provided; the absence of a KEV listing and lack of any reported POC suggest this is not yet being actively exploited opportunistically. The broad historical exposure (since version 3.2.0) combined with Nexus's prevalence in enterprise DevOps pipelines means a significant number of installations may have had secrets silently accessible via this API for extended periods. CVSS input is CVSS 4.0 only; no CVSS 3.1 vector was supplied in the source data.

An attacker with a low-privileged Nexus Repository 3 service account - such as a CI/CD pipeline credential or a developer account with read-only roles - queries the capability read API and extracts the plaintext webhook HMAC shared secret. The attacker then constructs forged, HMAC-signed webhook POST requests impersonating legitimate Nexus events, causing a downstream CI/CD system or deployment pipeline to execute unintended builds, deployments, or repository operations. No public exploit code has been identified at time of analysis, but the technique requires only a standard authenticated HTTP request.