CVE-2026-14646: Nexus Repository 3 SSRF Vulnerability

CVE-2026-14646 Overview

CVE-2026-14646 is a Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3. The product's existing SSRF protections were not applied to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server can trigger requests to internal network addresses or cloud metadata endpoints. When anonymous access is enabled, unauthenticated users can exploit the flaw. The response is returned as repository content, potentially exposing sensitive data such as cloud IAM credentials. The vulnerability is tracked under CWE-918.

Critical Impact
Attackers can pivot through Nexus proxy repositories to reach internal services and cloud metadata endpoints, retrieving IAM credentials and other sensitive data as repository content.

Affected Products

Sonatype Nexus Repository 3 (versions prior to 3.94.0)
Nexus Repository 3 instances configured with proxy repositories
Nexus Repository 3 deployments with anonymous access enabled (unauthenticated exposure)

Discovery Timeline

2026-07-14 - CVE-2026-14646 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-14646

Vulnerability Analysis

Nexus Repository 3 acts as a caching proxy for upstream package sources such as Maven Central, npm, or PyPI mirrors. When a client requests an artifact, Nexus fetches it from the configured upstream and caches the response. The product implements SSRF protections to prevent requests from targeting internal network ranges or cloud metadata services like 169.254.169.254. These protections are validated against the initial upstream URL configured by the administrator.

The vulnerability arises because the SSRF filter is not re-evaluated when the upstream server issues an HTTP redirect. If the upstream returns a 301, 302, or 307 response with a Location header pointing to an internal address, Nexus follows the redirect without validation. The response body from the internal target is then returned to the requesting user as legitimate repository content.

Root Cause

The root cause is incomplete input validation on HTTP redirect targets in the proxy fetch pipeline. SSRF checks are applied at the initial request stage but omitted from the redirect-following logic. This creates a trust boundary gap between the configured upstream URL and any URLs subsequently returned by that upstream.

Attack Vector

An attacker who controls or compromises an upstream server referenced by a Nexus proxy repository sets up a malicious endpoint. When a Nexus user requests any artifact from the proxy repository, Nexus queries the upstream. The upstream responds with an HTTP redirect to a target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ or an internal service endpoint. Nexus follows the redirect, fetches the metadata, and returns it to the requester as repository content. The retrieved AWS, Azure, or GCP credentials can then be used to pivot into the cloud environment. Refer to the Sonatype Support Article for vendor-provided technical context.

Detection Methods for CVE-2026-14646

Indicators of Compromise

Outbound HTTP requests from Nexus Repository hosts to cloud metadata IP addresses such as 169.254.169.254 or metadata.google.internal.
Nexus proxy repository requests resolving to RFC1918 internal addresses after upstream redirects.
Anomalous response payloads served from proxy repositories containing JSON credential structures or internal service banners.

Detection Strategies

Inspect Nexus request logs for upstream responses containing Location headers pointing to internal or link-local address ranges.
Correlate proxy repository fetch events with subsequent outbound connections from the Nexus host to non-standard destinations.
Alert on cloud IAM credential usage originating from Nexus service accounts or unexpected source IPs following proxy activity.

Monitoring Recommendations

Enable network egress logging on the Nexus Repository host and block traffic to cloud metadata endpoints from the Nexus process where feasible.
Monitor Nexus access logs for unusual proxy repository read patterns from anonymous or low-privilege accounts.
Track cloud provider audit logs for API calls made with the Nexus host's instance role, especially credential retrieval events.

How to Mitigate CVE-2026-14646

Immediate Actions Required

Upgrade Nexus Repository 3 to version 3.94.0 or later, which applies SSRF protections to redirect targets.
Audit configured proxy repositories and remove or reconfigure any pointing to untrusted upstream servers.
Disable anonymous access to proxy repositories unless explicitly required for public artifact distribution.

Patch Information

Sonatype addressed the issue in Nexus Repository 3.94.0. Full remediation details are documented in the Sonatype Nexus Release Notes. Administrators should review the Sonatype Support Article for guidance on validating the fix in their deployments.

Workarounds

Restrict outbound network access from Nexus Repository hosts using host-based firewall rules that deny traffic to cloud metadata addresses and internal management ranges.
Configure Nexus to use Instance Metadata Service Version 2 (IMDSv2) on AWS and require session tokens, reducing the impact of blind SSRF against metadata endpoints.
Limit proxy repository membership to authenticated users and require role-based access controls until the patch is applied.

bash

# Example iptables rule to block Nexus host access to AWS instance metadata
iptables -A OUTPUT -m owner --uid-owner nexus -d 169.254.169.254 -j DROP

# Enforce IMDSv2 on the underlying EC2 instance hosting Nexus
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled