CVE-2026-7494 Overview
CVE-2026-7494 is a Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3. The flaw resides in the SSL Certificate Retrieval endpoint, which authenticated users can abuse to force the server to initiate outbound connections to internal or otherwise restricted network hosts. Exploitation requires an authenticated account holding the nexus:ssl-truststore:read permission. The vulnerability affects Nexus Repository versions 3.0.0 through releases prior to 3.94.0. Sonatype addressed the issue in version 3.94.0. The weakness is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated attackers can pivot through Nexus Repository to probe internal network resources, enumerate services behind the perimeter, and potentially interact with cloud metadata endpoints.
Affected Products
- Sonatype Nexus Repository 3.0.0 through versions prior to 3.94.0
- Deployments granting users the nexus:ssl-truststore:read permission
- On-premises and self-hosted Nexus Repository 3 instances
Discovery Timeline
- 2026-07-14 - CVE-2026-7494 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-7494
Vulnerability Analysis
The vulnerability exists in the SSL Certificate Retrieval feature of Nexus Repository 3. This endpoint allows administrators to fetch and inspect SSL/TLS certificates from remote hosts before adding them to the Nexus truststore. The endpoint accepts a user-supplied hostname and port, then opens a TCP connection to that destination from the Nexus server itself.
Because the endpoint does not restrict the destination address, an authenticated attacker with the nexus:ssl-truststore:read permission can direct the server to connect to arbitrary internal hosts. This behavior enables classic SSRF attack patterns, including internal port scanning, service enumeration, and reaching services that are unreachable from the attacker's own network position.
Root Cause
The root cause is missing destination validation in the SSL truststore certificate retrieval handler. The endpoint does not enforce an allowlist, block RFC 1918 private ranges, or filter link-local and loopback addresses. This maps directly to CWE-918: Server-Side Request Forgery, where a server accepts user-controlled URLs or hostnames without validating whether the target is a permitted destination.
Attack Vector
Exploitation requires network access to the Nexus Repository web interface and valid credentials for an account with the nexus:ssl-truststore:read permission. The attacker submits a certificate retrieval request specifying an internal target such as a database server, cloud metadata service, or an internal admin interface. The Nexus server initiates the outbound TLS handshake, and response timing or returned data reveals whether the target host and port are reachable. See the Sonatype Support Article for vendor-provided technical context.
Detection Methods for CVE-2026-7494
Indicators of Compromise
- Outbound TCP connections from the Nexus Repository host to internal RFC 1918 addresses, 169.254.169.254 cloud metadata endpoints, or 127.0.0.1 on non-standard ports
- Unusual volume of requests to the SSL truststore certificate retrieval API endpoint from a single authenticated user
- Audit log entries showing nexus:ssl-truststore:read actions targeting non-repository hostnames
Detection Strategies
- Correlate Nexus application audit logs with host-level network telemetry to flag certificate retrieval requests that target internal address ranges
- Alert on repeated failed or short-lived TLS handshakes originating from the Nexus service account to non-repository infrastructure
- Baseline legitimate certificate retrieval targets and generate alerts for any destination outside that baseline
Monitoring Recommendations
- Enable and centrally forward Nexus Repository audit logs to a SIEM for long-term retention and correlation
- Monitor egress firewall logs for connections initiated by the Nexus host to internal management networks or cloud metadata IPs
- Review the assignment of the nexus:ssl-truststore:read permission and alert on new grants of this role
How to Mitigate CVE-2026-7494
Immediate Actions Required
- Upgrade Nexus Repository 3 to version 3.94.0 or later, which contains the vendor fix
- Audit all users and roles that hold the nexus:ssl-truststore:read permission and revoke it from accounts that do not require it
- Restrict outbound network access from the Nexus Repository host using egress firewall rules that permit only known upstream repository destinations
Patch Information
Sonatype resolved the vulnerability in Nexus Repository 3.94.0. Administrators should review the Sonatype Nexus Release Notes for upgrade instructions and the Sonatype Support Article for vendor guidance on this specific issue.
Workarounds
- Remove the nexus:ssl-truststore:read permission from all non-administrative roles until the upgrade can be applied
- Place the Nexus Repository server behind an egress proxy that enforces an allowlist of legitimate upstream repository hosts
- Block outbound traffic from the Nexus host to internal management subnets, cloud metadata services (169.254.169.254), and loopback ranges at the network layer
# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -m owner --uid-owner nexus -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner nexus -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner nexus -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner nexus -d 192.168.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
