Nexus Repository 3 EUVD-2026-54520

Exploitation requires an authenticated user account (PR:H per CVSS 4.0 vector) that has been explicitly granted a delegated repository-admin privilege scoped to at least one specific repository format. The anonymous user account cannot hold this privilege by default and is therefore not a viable attack path. The attack is conducted over the network via the repository-creation UI endpoint. The limiting factors are: (1) the attacker must be an authenticated, named user - not anonymous; (2) an administrator must have previously delegated repository-admin rights to that user for at least one format; (3) exploitation is limited to creating unauthorized repository types, not reading or deleting existing content. Organizations that grant broad, unscoped repository-admin rights to all admins face minimal additional risk, as those users can already create any format.

The CVSS 4.0 score of 8.2 is driven by the network attack vector, low complexity, and dual high-integrity impacts (VI:H on the vulnerable system, SI:H on subsequent systems), despite requiring high privileges (PR:H). This combination is accurate: the attacker must already hold a delegated repository-admin credential scoped to at least one format, which meaningfully constrains the attack surface to a subset of internal or trusted users. There is no evidence of active exploitation (no CISA KEV listing) and no public proof-of-concept has been disclosed. EPSS data was not provided in the input. Real-world risk is most relevant to organizations that practice fine-grained delegation of Nexus privileges across teams - in environments where all admins hold broad rights, the bypass adds little incremental capability. The primary concern is supply chain integrity: an attacker could introduce a Docker or PyPI repository in a namespace they should not control, potentially enabling dependency confusion or artifact poisoning scenarios downstream.

An internal developer or CI/CD service account granted repository-admin rights scoped to the npm format sends a crafted repository-creation request to the Nexus UI, supplying the permitted npm format in the authorization-checked field while specifying Docker or PyPI in the format instantiation field. The authorization check passes (npm is permitted), but a Docker repository is created instead. The attacker then publishes a malicious artifact into the unauthorized Docker repository, which may be pulled by pipelines that trust the Nexus instance, enabling a dependency confusion or supply chain poisoning attack.