CVE-2026-14646

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

Published Jul 5, 2026

support.sonatype.com

CVSS Score

Medium 4.9

Security Details

Components Impacted

CVE-2026-14646 Security Details

CVE ID
CVE-2026-14646

CWE
CWE-918 Learn more about CWE-918

CVE Description
Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

Published
Jul 5, 2026

CVSS Score & Severity
4.9 Medium

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

EPSS Score
0.265%

Malware
malware

KEV Status
Not in KEV Catalog: No known exploits

Vulnerable Methods
org/sonatype/nexus/httpclient/internal/NexusRedirectStrategy.getLocationURI(Lorg/apache/http/HttpRequest;Lorg/apache/http/HttpResponse;Lorg/apache/http/protocol/HttpContext;)Ljava/net/URI;

JVM
org/sonatype/nexus/httpclient/internal/NexusRedirectStrategy.isRedirected(Lorg/apache/http/HttpRequest;Lorg/apache/http/HttpResponse;Lorg/apache/http/protocol/HttpContext;)Z

JVM

Affected Ecosystems
affected

Source
National Vulnerability Database

References

support.sonatype.com PROJECT