Vulnerability · Published Jul 14, 2026 · Assigned by Sonatype
CVE-2026-14645Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability
Medium 5.1
In plain English
A medium-severity server-side request forgery in Nexus Repository 3 from Sonatype. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sonatype | Nexus Repository 3 | 3.0.0 – before 3.94.0 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N