CVE-2026-14645CWE-918ssrf

CVE-2026-14645

Medium · published July 14, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-14T21:16Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.0.0, < 3.94.03.94.0
References (2)
https://support.sonatype.com/hc/en-us/articles/53158843564179/ · 103e4ec9-0a87-450b-af77-479448ddef11https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 14 JUL 16:33Z
    Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability
    cvelistv5