CVE-2026-77123: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-77123 is a sensitive information disclosure vulnerability in Sonatype Nexus Repository 3's capability read API. An authenticated account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. The vulnerability affects Nexus Repository 3 versions 3.2.0 through 3.95.x and was disclosed on September 2, 2026, with a fix available in version 3.96.0. It carries a CVSS v4.0 base score of 6.0 (Medium) (Github Advisory, Sonatype Release Notes).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), where the capability read API transmits webhook shared secrets in plaintext rather than masking them as intended. An attacker with low-level authenticated access (the nexus:capabilities:read privilege) can issue a network request to the capabilities API endpoint and receive the unredacted HMAC shared secret used to authenticate webhook payloads. Exploitation requires the attacker to already possess the nexus:capabilities:read privilege and for webhook capabilities with shared secrets to be configured — these are the primary preconditions. No public proof-of-concept code has been identified (Github Advisory).

Successful exploitation allows an authenticated attacker to obtain plaintext webhook shared secrets that are supposed to be masked in all API responses. Exposure of these secrets could enable an attacker to forge or spoof webhook payloads, potentially undermining integrity controls in downstream systems that rely on HMAC signature verification. There is no direct impact on availability or integrity of the Nexus Repository system itself, but the credential exposure could facilitate further attacks against integrated systems or CI/CD pipelines that consume Nexus webhooks (Github Advisory, Sonatype Release Notes).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The EPSS score is approximately 0.27% (19th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" with the attack noted as non-automatable (Github Advisory).

1. Reconnaissance: Identify a Nexus Repository 3 instance running a version between 3.2.0 and 3.95.x, either through internal network access or internet-facing exposure.
2. Obtain low-privilege credentials: Acquire or compromise an account that holds the nexus:capabilities:read privilege — this may be a standard user account in environments with broad privilege assignment.
3. Query the capabilities API: Authenticate to the Nexus Repository API and send a GET request to the capabilities read endpoint (e.g., /service/rest/v1/capabilities or equivalent).
4. Extract plaintext secret: Parse the API response to retrieve the plaintext HMAC shared secret configured on any webhook capability, which should have been masked but is returned in cleartext.
5. Abuse the secret: Use the recovered shared secret to forge valid HMAC-signed webhook payloads, potentially manipulating downstream systems (e.g., CI/CD pipelines, security tools) that trust Nexus webhook events (Github Advisory).

• Logs: Nexus Repository access logs showing GET requests to the capabilities API endpoint (e.g., /service/rest/v1/capabilities) from accounts that do not typically query this endpoint, especially outside of normal administrative activity.
• Logs: Audit log entries for nexus:capabilities:read privilege usage by non-administrative or service accounts.
• Network: Unexpected outbound webhook traffic or webhook replay attempts to external endpoints using forged HMAC signatures.
• Behavioral: Downstream systems (CI/CD pipelines, security tools) receiving webhook events that were not triggered by legitimate Nexus Repository activity.

Sonatype has released a fix in Nexus Repository 3 version 3.96.0 (released September 1, 2026); upgrading to this version or later is the recommended remediation. For deployments unable to upgrade immediately, restrict the nexus:capabilities:read privilege to only trusted administrators and audit current role assignments to minimize exposure. Additionally, review all configured webhook capabilities and rotate any shared secrets that may have been exposed, then update downstream systems with the new secrets (Sonatype Release Notes, Github Advisory).