CVE-2026-14645: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-14645 is a Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3, specifically in the "Webhook: Global" capability. The server fails to validate the destination URL configured for the webhook before issuing outbound HTTP requests, allowing an attacker with the Capability Administration permission to cause the server to send requests to internal network locations. All Nexus Repository 3 CE/Pro versions from 3.0.0 up to and including 3.93.x are affected; the issue is fixed in version 3.94.0. It carries a CVSS v4.0 base score of 5.1 (Medium) (Sonatype Advisory, Sonatype Release Notes).

The root cause is CWE-918 (Server-Side Request Forgery): Nexus Repository 3 does not perform any validation or allowlist enforcement on the URL configured in the "Webhook: Global" capability before making an outbound HTTP request when the webhook fires. An attacker with the nx-capabilities-* (Capability Administration) permission can set this URL to an internal-only address — such as a cloud metadata endpoint, internal management interface, or private service — and trigger the webhook to cause the server to issue requests on their behalf. Critically, Nexus Repository evaluates permissions by role assignment independent of authentication status, meaning that if the anonymous role has been granted this permission, no credentials are required to exploit the vulnerability (Sonatype Advisory). The vulnerability was discovered and responsibly disclosed by researcher Ky0toFu via Sonatype's Bug Bounty Program (Sonatype Advisory).

Successful exploitation allows an attacker to cause the Nexus Repository server to issue arbitrary outbound HTTP requests to internal network locations not otherwise reachable from outside the server's network, including internal services, management interfaces, and cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). This can lead to unauthorized access to sensitive internal resources, potential credential theft from cloud metadata services, and reconnaissance of internal network topology. The integrity and confidentiality of internal systems reachable by the server are at risk, though direct availability impact is limited (Sonatype Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable. The EPSS score is approximately 0.397%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the Capability Administration permission, which is restricted to administrators by default, though misconfigured instances granting this permission to the anonymous role would be exploitable without authentication (Sonatype Advisory).

1. Reconnaissance: Identify internet-facing Nexus Repository 3 instances running versions 3.0.0–3.93.x using tools like Shodan or Censys, searching for Nexus Repository banners or login pages.
2. Permission check: Determine whether the target instance grants the nx-capabilities-* (Capability Administration) permission to the anonymous role by attempting to access the Capabilities administration endpoint without credentials. If anonymous access is not configured, obtain valid credentials for an account with this permission.
3. Configure malicious webhook URL: Navigate to Administration → Capabilities → "Webhook: Global" and set the webhook URL to an internal target (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata, or an internal service address).
4. Trigger the webhook: Perform an action that fires the global webhook (e.g., a repository event such as a component upload or deletion), causing the Nexus server to issue an outbound HTTP request to the configured internal URL.
5. Collect response data: If the webhook response or server behavior reflects any data from the internal target (e.g., via error messages or logs), extract sensitive information such as cloud credentials or internal service details (Sonatype Advisory).

• Network: Unexpected outbound HTTP requests from the Nexus Repository server to internal IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254); outbound connections to unusual internal ports or services originating from the Nexus process.
• Logs: Nexus Repository audit logs showing creation or modification of a "Webhook: Global" capability with an internal or non-standard URL; HTTP request logs showing outbound connections to internal addresses triggered by webhook events.
• Configuration: The "Webhook: Global" capability configured with a URL pointing to an internal network address, localhost, or cloud metadata endpoint rather than an expected external webhook receiver.

Sonatype has released a fix in Nexus Repository 3.94.0 (released July 9, 2026), which validates the webhook destination URL before issuing outbound requests. All users running versions 3.0.0 through 3.93.x should upgrade to 3.94.0 or later immediately (Sonatype Advisory, Sonatype Release Notes). As a workaround prior to patching, administrators should audit role assignments to ensure the nx-capabilities-* permission is not granted to the anonymous role or any untrusted users, and restrict network egress from the Nexus server to only approved external destinations using firewall rules.

Sonatype disclosed this vulnerability on July 14, 2026, as part of a batch of security advisories covering multiple Nexus Repository 3 issues, including additional SSRF variants (CVE-2026-14646, CVE-2026-7494) and other vulnerabilities. The coordinated disclosure reflects Sonatype's stated responsible disclosure process and Bug Bounty Program. No significant independent researcher commentary or broad media coverage has been identified beyond the official advisory (Sonatype Advisory).