CVE-2026-14645 Overview
CVE-2026-14645 is a Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3. The flaw exists in the Webhook: Global capability, which fails to validate the destination URL before issuing outbound HTTP requests. A user holding the Capability Administration permission can direct the server to send requests to internal network locations. Because the permission is granted through role assignment, an unauthenticated attacker can also trigger the behavior if the anonymous role has been granted this permission. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Attackers can pivot from the Nexus Repository server to reach internal-only services, cloud metadata endpoints, and other systems typically shielded from external networks.
Affected Products
- Sonatype Nexus Repository 3 (versions prior to 3.94.0)
- Deployments where the anonymous role has been granted Capability Administration permission
- Self-hosted Nexus Repository 3 instances exposed to untrusted networks
Discovery Timeline
- 2026-07-14 - CVE-2026-14645 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-14645
Vulnerability Analysis
The vulnerability resides in the Webhook: Global capability of Nexus Repository 3. Administrators use this capability to configure outbound webhook notifications for repository events. The server accepts a user-supplied URL and issues HTTP requests to that destination without validating whether the target is a permitted external endpoint.
This missing validation lets an attacker set the webhook URL to an internal address such as http://127.0.0.1, http://169.254.169.254, or private RFC 1918 ranges. The Nexus server then issues authenticated or unauthenticated HTTP requests to those internal destinations on the attacker's behalf.
The impact extends beyond simple internal reconnaissance. Attackers can probe internal services, interact with cloud instance metadata endpoints to retrieve credentials, and reach management interfaces that trust requests originating from the Nexus host.
Root Cause
The root cause is missing destination validation prior to outbound HTTP invocation in the Webhook: Global capability handler. The code does not enforce an allowlist of destinations, block private address ranges, or deny loopback and link-local addresses. The permission model compounds the flaw because Capability Administration can be assigned to the anonymous role, removing the authentication barrier entirely.
Attack Vector
An attacker with Capability Administration permission navigates to the capability configuration and creates or modifies a Webhook: Global entry. The attacker supplies a URL pointing to an internal service and triggers the webhook. The Nexus server issues the outbound request from its own network position and may return response indicators that reveal service behavior. Refer to the Sonatype Support Article for vendor-provided technical details.
No verified public exploit code is available. See the Sonatype Nexus Release Notes for vendor guidance.
Detection Methods for CVE-2026-14645
Indicators of Compromise
- Outbound HTTP requests from the Nexus Repository host to internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254
- Audit log entries showing creation or modification of Webhook: Global capabilities by anonymous or low-trust accounts
- Unexpected webhook configurations pointing to non-production URLs or private network addresses
Detection Strategies
- Review Nexus audit logs for capability configuration changes, specifically entries referencing webhook.global or capability creation events
- Correlate Nexus server egress traffic against a baseline of expected webhook destinations and flag deviations
- Monitor role assignments for the anonymous role to detect grants of Capability Administration permission
Monitoring Recommendations
- Enable and centrally collect Nexus Repository audit logs, forwarding them to your SIEM for retention and correlation
- Instrument network egress from the Nexus host and alert on connections to RFC 1918 ranges, 127.0.0.0/8, and link-local 169.254.0.0/16
- Track capability configuration changes as high-priority events and require ticketed change approval
How to Mitigate CVE-2026-14645
Immediate Actions Required
- Upgrade Nexus Repository 3 to version 3.94.0 or later as documented in the Sonatype Nexus 3.94.0 Release Notes
- Audit all role assignments and remove Capability Administration from the anonymous role and any non-administrative users
- Review existing Webhook: Global capability entries and delete any pointing to internal or unexpected destinations
Patch Information
Sonatype addressed the vulnerability in Nexus Repository 3.94.0. The fix introduces destination validation on webhook URLs. Consult the Sonatype Support Article for upgrade steps and version-specific notes.
Workarounds
- Restrict Capability Administration to a minimal set of trusted administrators until the patch is applied
- Place the Nexus Repository server behind an egress proxy that blocks connections to internal IP ranges and cloud metadata endpoints
- Disable the anonymous role or ensure it holds no capability-related permissions
# Example egress firewall rules blocking SSRF targets from the Nexus host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
