Server-Side Request Forgery Vulnerability in Sonatype Nexus Repository
CVE-2026-0600

6.2MEDIUM

Key Information:

Vendor

Sonatype

Status
Nexus Repository
Vendor
CVE Published:
14 January 2026

What is CVE-2026-0600?

A Server-Side Request Forgery (SSRF) vulnerability exists in Sonatype Nexus Repository versions 3.0.0 and later, allowing authenticated administrators to set up proxy repositories that can make requests to unauthorized network locations. This may expose sensitive internal network resources and cloud metadata services, as the configuration permits access to destinations that should be restricted. Although a workaround that mitigates this issue was introduced in version 3.88.0, the default settings still leave the system vulnerable, potentially compromising security.

Affected Version(s)

Nexus Repository 3.0.0

References

https://support.sonatype.com/hc/en-us/articles/4792885581...
vendor-advisory

CVSS V4

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc.
.