# CVE-2026-14646

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

Published Jul 5, 2026

[support.sonatype.com](https://support.sonatype.com/hc/en-us/articles/53165019641363-CVE-2026-14646-Nexus-Repository-3-SSRF-via-HTTP-Redirect-2026-07-14)

## CVSS Score
Medium 4.9

### Security Details

**Components Impacted**

### CVE-2026-14646 Security Details

**CVE ID**  
CVE-2026-14646

**CWE**  
CWE-918 [Learn more about CWE-918](https://cwe.mitre.org/data/definitions/918.html)

**CVE Description**  
Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

**Published**  
Jul 5, 2026

**CVSS Score & Severity**  
4.9 Medium

**CVSS Vector**  
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

**EPSS Score**  
0.265%

**Malware**  
malware

**KEV Status**  
Not in KEV Catalog: No known exploits

**Vulnerable Methods**  
org/sonatype/nexus/httpclient/internal/NexusRedirectStrategy.getLocationURI(Lorg/apache/http/HttpRequest;Lorg/apache/http/HttpResponse;Lorg/apache/http/protocol/HttpContext;)Ljava/net/URI;

JVM  
org/sonatype/nexus/httpclient/internal/NexusRedirectStrategy.isRedirected(Lorg/apache/http/HttpRequest;Lorg/apache/http/HttpResponse;Lorg/apache/http/protocol/HttpContext;)Z

JVM

**Affected Ecosystems**  
affected

**Source**  
National Vulnerability Database

### References

[support.sonatype.com](https://support.sonatype.com/hc/en-us/articles/53165019641363-CVE-2026-14646-Nexus-Repository-3-SSRF-via-HTTP-Redirect-2026-07-14 "https://support.sonatype.com/hc/en-us/articles/53165019641363-CVE-2026-14646-Nexus-Repository-3-SSRF-via-HTTP-Redirect-2026-07-14") PROJECT