Nexus Repository 3 EUVD-2026-70228

Exploitation requires the attacker to hold a valid Nexus Repository account that has been explicitly granted the nexus:blobstores:create named permission by an administrator - this permission is not assigned by default. The target Nexus instance must be network-reachable via its REST API. No other special configuration or non-default feature is required; any Nexus Repository 3 deployment prior to 3.96.0 with at least one account holding this permission is vulnerable. Limiting factors: the permission must be deliberately assigned, ruling out fully unauthenticated attack paths; and the attacker needs knowledge of existing blobstore names to target.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) scores 7.1 (High), reflecting a network-accessible, low-complexity attack requiring only low privileges with no user interaction and a high integrity impact. The key limiting factor is PR:L: exploitation requires the nexus:blobstores:create permission to have been explicitly granted by an administrator - it is not a default permission. This is not a zero-bar attack; the threat actor must already hold a named, deliberately assigned role within the Nexus instance. The practical blast radius is unauthorized structural alteration of blobstore configuration, which could redirect artifact storage, disrupt repository availability, or mask supply chain tampering - all high-integrity concerns in a CI/CD context. No public exploit code exists and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation. EPSS data was not provided. Overall, the risk is real for organizations with granular delegated permissions but limited for installations where only full administrators manage blobstores.

An insider or compromised account that has been granted the nexus:blobstores:create permission - perhaps a build automation service account - authenticates to the Nexus REST API and sends a crafted request to the blobstore group management endpoint. The incorrect permission check passes, allowing the account to convert a production blobstore into a group blobstore, potentially rerouting artifact resolution to an attacker-controlled storage backend as part of a supply chain attack. No public exploit code exists, but the API call structure would be straightforward for anyone with knowledge of the Nexus REST API.