PT-2026-2966 · Sonatype · Sonatype Nexus Repository+1

Kazuma Matsumoto · Published 2026-01-14 · Updated 2026-01-15 · CVE-2026-0600

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions 3.0.0 and later

Description A Server-Side Request Forgery (SSRF) issue exists in Sonatype Nexus Repository. Authenticated administrators can configure proxy repositories with URLs that may access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

Recommendations Versions prior to 3.88.0 are vulnerable. Apply the workaround configuration available in version 3.88.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-0600

Affected Products

Nexus Repository Manager

Sonatype Nexus Repository

References · 4

• https://support.sonatype.com/hc/en-us/articles/47928855816595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0600 · Security Note
• https://twitter.com/CVEnew/status/2011759588811391467 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011723351895507182 · Twitter Post