PT-2026-58100 · Sonatype · Nexus Repository 3

Ky0Tofu · Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-14645

NVD

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-14645

Affected Products

Nexus Repository 3

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-14645 · Security Note
• https://support.sonatype.com/hc/en-us/articles/53158843564179 · Vendor Advisory
• https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html · Patch