PT-2026-58099 · Sonatype · Nexus Repository

Muhamad Burhanudin · CVE-2026-7494 · Publicado 2026-07-14 · Atualizado 2026-07-14

Mitre

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-7494

Produtos afetados

Nexus Repository

Referências · 3

• https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html · Correção
• https://support.sonatype.com/hc/en-us/articles/53126069518227 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-7494 · Nota de Segurança