CVE-2026-14504: Nexus Repository 3 Auth Bypass Flaw

CVE-2026-14504 Overview

CVE-2026-14504 is an authorization bypass vulnerability in Sonatype Nexus Repository 3's component upload API. The flaw allows a user holding only read or browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts. The API fails to enforce the intended write-permission check before accepting uploads.

The vulnerability is tracked under CWE-862: Missing Authorization and carries a CVSS v4.0 score of 8.2. Successful exploitation compromises artifact integrity, enabling attackers to inject malicious packages into repositories consumed by downstream build pipelines and developers.

Critical Impact
Low-privileged authenticated users can inject arbitrary artifacts into Swift, Terraform, and Conda hosted repositories, enabling supply chain compromise of any consumer pulling from the affected repository.

Affected Products

Sonatype Nexus Repository 3 (versions prior to 3.94.0)
Nexus Repository 3 Swift hosted repositories
Nexus Repository 3 Terraform and Conda hosted repositories

Discovery Timeline

2026-07-14 - CVE-2026-14504 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-14504

Vulnerability Analysis

The defect resides in the component upload API path handling for three specific hosted repository formats: Swift, Terraform, and Conda. Nexus Repository 3 evaluates repository content permissions through a privilege model that separates read, browse, edit, and add actions. For these three formats, the upload endpoint fails to require the add privilege on the target repository.

An authenticated user with only view-level access can therefore issue a POST request to the upload API and place new artifacts into the repository. The vulnerability affects artifact integrity but does not directly expose confidentiality or availability, which aligns with the CVSS vector describing a high impact to vulnerable-system integrity only.

Root Cause

The root cause is a missing authorization check in the format-specific upload handlers for Swift, Terraform, and Conda. The generic component upload framework in Nexus Repository 3 relies on each format handler to declare the required privilege. In the affected handlers, the write-permission verification was either omitted or evaluated against an incorrect action, allowing the request to proceed once basic authentication succeeded.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker authenticates with a low-privilege account that possesses only nx-repository-view-<format>-<repo>-read or browse permissions. The attacker then submits a crafted upload request to the Swift, Terraform, or Conda upload API endpoint with an arbitrary artifact payload.

Because Nexus Repository is commonly integrated with CI/CD systems, an uploaded malicious Terraform module or Conda package can propagate into infrastructure-as-code deployments or data-science environments. This creates a viable path for internal supply chain attacks. See the Sonatype Support Article for vendor guidance.

Detection Methods for CVE-2026-14504

Indicators of Compromise

Unexpected artifacts appearing in Swift, Terraform, or Conda hosted repositories with authors that lack add privileges.
Audit log entries showing successful component uploads from user accounts whose role assignments include only read or browse privileges.
New package versions in these repositories that do not correspond to any known CI/CD publish job or approved release pipeline.

Detection Strategies

Review the Nexus audit log for REPOSITORY_ITEM.CREATED events on Swift, Terraform, and Conda repositories and correlate against the acting user's effective privileges.
Compare artifact publisher identities in repository metadata against the list of accounts authorized to publish to each hosted repository.
Enable request logging on the Nexus HTTP layer and search for POST requests to Swift, Terraform, and Conda upload endpoints originating from non-publisher accounts.

Monitoring Recommendations

Forward Nexus Repository audit and access logs to a centralized SIEM and alert on component creation events from unexpected principals.
Track baseline publish rates per repository and flag deviations that indicate unauthorized uploads.
Monitor downstream build systems for consumption of newly published artifacts and cross-reference against the approved release inventory.

How to Mitigate CVE-2026-14504

Immediate Actions Required

Upgrade Nexus Repository 3 to version 3.94.0 or later as documented in the Sonatype Release Notes.
Audit all Swift, Terraform, and Conda hosted repositories for artifacts uploaded since the vulnerability's introduction and remove any unauthorized components.
Rotate any credentials or tokens that granted read or browse access to affected repositories if abuse is suspected.

Patch Information

Sonatype resolved CVE-2026-14504 in Nexus Repository 3.94.0. The fix enforces the correct add privilege check within the upload handlers for Swift, Terraform, and Conda hosted repositories. Administrators running earlier 3.x builds must upgrade to 3.94.0 or a subsequent release. Refer to the Sonatype Support Article for step-by-step upgrade procedures.

Workarounds

If immediate upgrade is not possible, remove all Swift, Terraform, and Conda hosted repositories that are not strictly required until the patched version can be deployed.
Restrict read and browse privileges on affected repository formats to trusted service accounts only, reducing the population of accounts able to trigger the bypass.
Place Nexus Repository behind a reverse proxy that enforces path-based access controls on Swift, Terraform, and Conda upload endpoints.

bash

# Example: block low-privilege access to affected upload endpoints at a reverse proxy
location ~ ^/repository/(swift|terraform|conda)-hosted/ {
    limit_except GET HEAD {
        allow 10.0.0.0/24;   # CI/CD publisher subnet
        deny  all;
    }
    proxy_pass http://nexus_backend;
}