CVE-2026-77123
Received Received - Intake

Sensitive Information Disclosure in Nexus Repository 3

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Sonatype

Description
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-77123
EUVD
EUVD-2026-70230

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sonatype nexus_repository 3.96.0
sonatype nexus_repository From 3.2.0 (inc) to 3.95.x (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Nexus Repository 3 allows an attacker with the nexus:capabilities:read privilege to retrieve the plaintext shared secret of a configured webhook capability through the capability read API. The shared secret is normally masked and not exposed in API responses.

Detection Guidance

To detect this vulnerability, check Nexus Repository 3 versions between 3.2.0 and 3.95.x. Verify if any accounts with the nexus:capabilities:read privilege can access plaintext shared secrets via the capability read API. Review API logs for unauthorized access to webhook shared secrets.

Impact Analysis

An attacker could gain access to the shared secret, potentially allowing them to intercept or manipulate webhook communications. This could lead to unauthorized actions or data breaches if the webhook is used for critical integrations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR or HIPAA requirements for protecting personal or health information. Compliance may be impacted if the webhook handles regulated data.

Mitigation Strategies

Upgrade Nexus Repository 3 to version 3.96.0 or later. Restrict the nexus:capabilities:read privilege to trusted administrators only. Rotate webhook shared secrets if the privilege was delegated to non-administrative accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77123. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart