Nexus Repository 3 Server-Side Request Forgery via Webhook URL

Executive Summary

CVE-2026-14645 is a Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3. The vulnerability occurs because Nexus Repository does not validate the destination URL configured in the 'Webhook: Global' capability before making outbound HTTP requests.

An attacker with the Capability Administration permission can exploit this flaw to force the server to send requests to internal network locations. These locations could include internal services, management interfaces, or cloud metadata endpoints that are normally inaccessible from outside the server's network.

The Capability Administration permission is typically restricted to administrators, but it can be assigned via role assignment. This means an unauthenticated user could also exploit the vulnerability if the anonymous role has been granted this permission.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking if your Nexus Repository 3 instance is configured with a 'Webhook: Global' capability that could be abused for SSRF. Since the vulnerability allows outbound HTTP requests to internal network locations, you can monitor for unusual outbound traffic from the Nexus server.

• Check the Nexus Repository version: Ensure it is not running a vulnerable version (before 3.94.0). You can verify the version by accessing the Nexus Repository admin interface or checking the version file in the installation directory.
• Review the 'Webhook: Global' capability configuration: Log in to the Nexus Repository admin interface, navigate to 'Capabilities,' and inspect the 'Webhook: Global' settings. Look for any suspicious or unintended URLs configured as destinations.
• Audit role permissions: Verify that the Capability Administration permission is not granted to the anonymous role or any unintended users. This can be checked under 'Security' > 'Roles' in the admin interface.
• Monitor outbound network traffic: Use network monitoring tools (e.g., Wireshark, tcpdump) to inspect outbound HTTP requests from the Nexus server. Look for requests to internal IP addresses or unexpected external destinations.

Example command to check outbound traffic from the Nexus server (Linux):

• sudo tcpdump -i any -n 'host <Nexus_Server_IP> and (tcp port 80 or tcp port 443)' -v

Example command to check the Nexus version (if you have access to the server):

• cat /opt/sonatype/nexus/public/sonatype-work/nexus3/system/net/static/rapture/rapture.json | grep version

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of Nexus Repository 3.

• An attacker could force the Nexus Repository server to send requests to internal systems, potentially exposing sensitive internal services or data.
• If the attacker targets cloud metadata endpoints, they might gain access to sensitive cloud credentials or configuration details.
• The vulnerability could be exploited without authentication if the anonymous role has been granted the Capability Administration permission, increasing the risk of unauthorized access.
• Exploitation could lead to further attacks, such as lateral movement within your network or unauthorized access to internal resources.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with common standards and regulations in the following ways:

• GDPR: If the SSRF vulnerability leads to unauthorized access to personal data stored in internal systems, it could result in a data breach. Under GDPR, organizations must protect personal data from unauthorized access, and a breach could lead to significant fines and legal consequences.
• HIPAA: For organizations handling protected health information (PHI), this vulnerability could expose internal systems containing PHI. Unauthorized access to such systems would violate HIPAA's security and privacy rules, potentially resulting in penalties.
• Other standards (e.g., ISO 27001, NIST): The vulnerability represents a failure to implement adequate access controls and network security measures. This could lead to non-compliance with requirements for protecting sensitive information and maintaining secure systems.

Organizations should assess the potential impact of this vulnerability on their compliance posture and take corrective actions, such as upgrading to a patched version of Nexus Repository 3, to mitigate risks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Nexus Repository: The most effective mitigation is to upgrade to Nexus Repository 3 CE/Pro version 3.94.0 or later, as this version addresses the vulnerability. Follow Sonatype's upgrade instructions to ensure a smooth transition.
• Restrict Capability Administration permissions: Ensure that the Capability Administration permission is not granted to the anonymous role or any unintended users. Review and update role assignments under 'Security' > 'Roles' in the admin interface.
• Disable or remove suspicious 'Webhook: Global' configurations: If you do not use the 'Webhook: Global' capability, disable or remove it. If it is in use, ensure the configured URL is trusted and not pointing to internal or unintended destinations.
• Monitor and block outbound traffic: Use network firewalls or security groups to restrict outbound HTTP/HTTPS traffic from the Nexus server to only trusted external destinations. Block access to internal network ranges unless explicitly required.
• Enable logging and alerts: Configure Nexus Repository to log outbound webhook requests and set up alerts for any unusual activity. This can help detect potential exploitation attempts.

Useful 0 Not Useful 0