© 2026 vulntracker.io

CVE-2026-14646

Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect

HIGH

7.7

CVSS Score

Published: July 14, 2026 at 04:49 PM UTC

Updated: October 24, 2026 at 09:10 PM UTC

1 product affected across 1 vendorNexus Repository Manager

Using Nexus Repository 3 by Sonatype?

Get instant alerts when new vulnerabilities affect Nexus Repository 3 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.7

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Nexus Repository Manager · Sonatype

95%

3.0.0 ≤ v < 3.94.03.0.0 3.0.1 3.0.2 3.1.0 3.10.0 3.11.0 3.12.0 3.12.1 3.13.0 3.14.0 3.15.0 3.15.1 3.15.2 3.16.0 3.16.1 3.16.2 3.17.0 3.18.0 3.18.1 3.19.0 3.19.1 3.2.0 3.2.1 3.20.0 3.20.1 3.21.0 3.21.1 3.21.2 3.22.0 3.22.1 3.23.0 3.24.0 3.25.0 3.25.1 3.26.0 3.26.1 3.27.0 3.28.0 3.28.1 3.29.0 3.29.2 3.3.0 3.3.1 3.3.2 3.30.0 3.30.1 3.31.0 3.31.1 3.32.0 3.32.1 3.33.0 3.33.1 3.34.0 3.34.1 3.35.0 3.36.0 3.37.0 3.37.1 3.37.2 3.37.3 3.38.0 3.38.1 3.39.0 3.4.0 3.40.0 3.40.1 3.41.0 3.41.1 3.42.0 3.43.0 3.44.0 3.45.0 3.45.1 3.46.0 3.47.0 3.47.1 3.48.0 3.49.0 3.5.0 3.5.1 3.5.2 3.50.0 3.51.0 3.52.0 3.53.0 3.53.1 3.54.0 3.54.1 3.55.0 3.56.0 3.57.0 3.57.1 3.58.0 3.58.1 3.59.0 3.6.0 3.6.1 3.6.2 3.60.0 3.61.0 3.62.0 3.63.0 3.64.0 3.65.0 3.66.0 3.67.0 3.67.1 3.68.0 3.68.1 3.69.0 3.7.0 3.7.1 3.70.0 3.70.1 3.70.2 3.70.3 3.70.4 3.70.5 3.71.0 3.72.0 3.73.0 3.74.0 3.75.0 3.75.1 3.76.0 3.76.1 3.77.0 3.78.0 3.78.1 3.79.0 3.8.0 3.80.0 3.81.0 3.82.0 3.83.0 3.83.1 3.83.2 3.84.0 3.84.1 3.84.2 3.85.0 3.85.1 3.86.0 3.86.2 3.86.3 3.87.0 3.87.1 3.87.2 3.88.0 3.89.0 3.89.1 3.9.0 3.90.0 3.90.1 3.90.2 3.90.3 3.91.0 3.91.1 3.92.0 3.92.1 3.92.2 3.92.3 3.93.0 3.93.1 3.93.2

Affected range stops below 3.94.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

PatchPermissions Required

Source: cverecord

https://help.sonatype.com/en/sonatype-nexus-repository-3-94-0-release-notes.html

Vendor Advisory

Source: cverecord

https://support.sonatype.com/hc/en-us/articles/53165019641363/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.7HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: CHANGED
Confidentiality: NONE
Integrity: HIGH
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-918

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card