PT-2026-58099 · Sonatype · Nexus Repository

Muhamad Burhanudin · CVE-2026-7494 · Published 2026-07-14 · Updated 2026-07-14

Mitre

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-7494

Affected Products

Nexus Repository

References · 3

• https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html · Patch
• https://support.sonatype.com/hc/en-us/articles/53126069518227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7494 · Security Note