CVE-2026-14644: Nexus Repository 3 Privilege Escalation

CVE-2026-14644 Overview

CVE-2026-14644 is a privilege escalation vulnerability in Sonatype Nexus Repository 3. The flaw resides in the REST privileges API and stems from a type-confusion condition [CWE-843] in the privilege update endpoint. An authenticated user who already holds permission to manage privileges can, under specific role configurations, escalate their own account to full administrator by sending a crafted request to the vulnerable endpoint. The vulnerability affects deployments that rely on Nexus Repository 3 for artifact management in continuous integration and continuous delivery (CI/CD) pipelines, making it relevant to software supply chain security.

Critical Impact
Authenticated users with privilege-management rights can escalate to administrator, gaining full control over repositories, credentials, and stored artifacts.

Affected Products

Sonatype Nexus Repository 3 (versions prior to 3.95.0)
Nexus Repository 3 deployments exposing the REST privileges API
Environments where non-admin users hold privilege-management roles

Discovery Timeline

2026-08-07 - CVE-2026-14644 published to the National Vulnerability Database (NVD)
2026-08-08 - Last updated in NVD database

Technical Details for CVE-2026-14644

Vulnerability Analysis

The vulnerability is a type-confusion flaw [CWE-843] in the REST privileges API of Nexus Repository 3. Type confusion occurs when code interprets a resource as a different type than the one originally assigned, allowing attacker-supplied data to bypass validation logic. In this case, the privilege update endpoint mishandles the type associated with a privilege object during modification.

An authenticated user with rights to manage privileges can craft a request that causes the server to treat the submitted payload as a different privilege type. The mismatched handling permits the user to alter privileges they should not otherwise be able to control. The end result is a horizontal-to-vertical privilege escalation that grants full administrator access to the Nexus instance.

Root Cause

The root cause is missing or incorrect type validation in the privilege update handler. The endpoint accepts a privilege identifier and payload but fails to verify that the runtime type of the referenced privilege matches the operation being performed. That gap enables the attacker to substitute an unexpected privilege type and bypass role boundary checks.

Attack Vector

Exploitation requires network access to the Nexus Repository REST API and a valid account with permission to manage privileges. No user interaction is required. The attacker sends a crafted HTTP request to the privilege update endpoint that triggers the type-confusion condition. After the request succeeds, the attacker's account is promoted to administrator, permitting arbitrary changes to repository configuration, user accounts, and stored build artifacts.

Because exploitation requires an authenticated account with a specific role, the practical attack surface is limited to insider abuse or scenarios where a lower-privileged account has been compromised through phishing or credential theft.

Detection Methods for CVE-2026-14644

Indicators of Compromise

Unexpected changes to user roles or privileges within the Nexus audit log, particularly promotions to the nx-admin role.
HTTP requests to /service/rest/v1/security/privileges/* originating from non-administrative accounts.
Creation of new administrator accounts or API tokens shortly after privilege API activity.
Modifications to repository configurations, cleanup policies, or deployment targets performed by newly elevated accounts.

Detection Strategies

Correlate REST API access logs against the current role membership of each authenticated user to flag privilege changes performed by non-admins.
Alert on any successful PUT or POST request to the privileges endpoint that is followed within a short window by role reassignment or admin login by the same principal.
Baseline normal privilege-management activity per user account and detect deviations in request volume, timing, or payload structure.

Monitoring Recommendations

Forward Nexus Repository access and audit logs to a centralized SIEM for correlation with identity and endpoint telemetry.
Monitor authentication events for the Nexus service account and any user granted the nx-privileges-* permissions.
Track downstream artifact publish and download events for signs of tampering following any suspicious privilege modification.

How to Mitigate CVE-2026-14644

Immediate Actions Required

Upgrade Nexus Repository 3 to version 3.95.0 or later, which contains the vendor fix.
Audit all accounts currently holding privilege-management permissions and remove them from users who do not require the capability.
Review recent audit logs for unauthorized privilege changes and revoke any suspicious administrator grants.
Rotate credentials, API tokens, and signing keys stored in or accessible through the Nexus instance if compromise is suspected.

Patch Information

Sonatype addressed CVE-2026-14644 in Nexus Repository 3.95.0. Details are available in the Sonatype Nexus Release Notes and the Sonatype Support Article. Administrators should apply the update as soon as maintenance windows permit and validate the upgrade against a staging environment before production rollout.

Workarounds

Restrict network access to the Nexus REST API using firewall rules or a reverse proxy that permits only trusted management hosts.
Remove the privilege-management capability from all non-administrator roles until the patch is deployed.
Enforce multi-factor authentication (MFA) for all Nexus user accounts to reduce the risk of a lower-privileged account being compromised and used to trigger exploitation.

bash

# Example: list users and their assigned roles using the Nexus REST API
curl -u admin:$ADMIN_PWD \
  -H "Accept: application/json" \
  https://nexus.example.com/service/rest/v1/security/users | \
  jq '.[] | {userId, roles}'

# Example: remove a role from a user to reduce blast radius before patching
curl -u admin:$ADMIN_PWD -X PUT \
  -H "Content-Type: application/json" \
  -d '{"userId":"builduser","firstName":"Build","lastName":"User","emailAddress":"build@example.com","source":"default","status":"active","roles":["nx-anonymous"]}' \
  https://nexus.example.com/service/rest/v1/security/users/builduser