CVE-2026-77122: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-77122 is an authorization bypass vulnerability in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) of Sonatype Nexus Repository 3. It allows an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it holds no direct permission, by querying the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. The anonymous user is also affected if it has been granted the relevant permission. Affected versions span from 3.38.0 up to (but not including) 3.96.0, and the vulnerability carries a CVSS v4 base score of 5.3 (Medium) (Github Advisory, Sonatype Release Notes).

The root cause is classified as CWE-863 (Incorrect Authorization): the REST API endpoint performs an authorization check based on group repository permissions but fails to correctly enforce access controls for individual member repositories when they are queried directly. An attacker with low-privilege access (read or browse on a group repository) can bypass the intended permission boundary by issuing a direct HTTP GET request to /service/rest/v1/repositories/{memberRepositoryName}, where memberRepositoryName refers to a repository they have no explicit permission on. No special tools or complex conditions are required — the attack is network-accessible, low-complexity, and requires no user interaction (Github Advisory).

Successful exploitation results in unauthorized disclosure of repository metadata, including — for proxy repositories — the configured remote URL, which may expose internal upstream hostnames or private infrastructure details. This is a confidentiality-only impact with no integrity or availability consequences. In environments where the anonymous user has been granted group repository browse permissions, the exposure may extend to unauthenticated users, broadening the attack surface. The leaked internal hostnames could facilitate reconnaissance for further attacks against internal systems (Github Advisory, Sonatype Release Notes).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.215%, placing it in the 12th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and the technical impact as "partial."

1. Reconnaissance: Identify a Sonatype Nexus Repository 3 instance running a version between 3.38.0 and 3.95.x. Confirm the instance exposes the REST API (typically at /service/rest/v1/).
2. Obtain low-privilege access: Acquire or use an existing account with read or browse permission on any group repository, or leverage the anonymous user if it has been granted such permission.
3. Enumerate group repository members: Query the group repository's details via GET /service/rest/v1/repositories/{groupRepositoryName} to identify the names of member repositories.
4. Access restricted member repository metadata: Issue a direct GET /service/rest/v1/repositories/{memberRepositoryName} request for each member repository name, bypassing the authorization check that should restrict access.
5. Extract sensitive metadata: For proxy-type member repositories, parse the response to retrieve the configured remote URL, which may disclose internal upstream hostnames or private artifact server addresses (Github Advisory).

• Network: Unusual or repeated HTTP GET requests to /service/rest/v1/repositories/{repositoryName} for repository names that the requesting account does not have direct permissions on; requests originating from the anonymous user or low-privilege accounts querying multiple repository names in rapid succession.
• Logs: Nexus Repository access logs showing successful 200 responses to REST API repository detail requests for member repositories by accounts that only hold group-level permissions; access log entries from the anonymous user account querying individual repository endpoints.
• Behavioral: A pattern of sequential API calls enumerating multiple repository names, particularly targeting proxy repositories, which may indicate automated reconnaissance.

Sonatype addressed this vulnerability in Nexus Repository 3.96.0, released September 1, 2026. Organizations should upgrade to version 3.96.0 or later as the primary remediation (Sonatype Release Notes, Github Advisory). As interim workarounds: review and restrict read or browse permissions on group repositories to only necessary accounts; verify that the anonymous user does not have read or browse permissions on group repositories unless explicitly required; and consider network segmentation to limit exposure of the Nexus REST API to trusted networks only.