CVE-2026-3048CWE-502CWE-918insecure-deserializationssrf

CVE-2026-3048

Low · published May 11, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00286 · 20.0th percentile
Weaknesses
CWE-502 · Deserialization of Untrusted Data; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-11T22:16Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.0.0, < 3.92.03.92.0
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/51591695462675 · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 11 MAY 17:11Z
    Nexus Repository 3 - Improper LDAP Referral Handling
    cvelistv5