CVE-2026-77122 Overview
CVE-2026-77122 is an authorization flaw in Sonatype Nexus Repository 3. The REST API endpoint GET /service/rest/v1/repositories/{repositoryName} fails to enforce permissions correctly on group repository members. An account holding only read or browse permission on a group repository can query the endpoint directly for a member repository name and retrieve its metadata. For proxy repositories, the returned metadata includes the configured remote URL, which can expose internal upstream hostnames. The flaw also applies to the anonymous user if that role has been granted the relevant permission. The weakness is classified as CWE-863: Incorrect Authorization.
Critical Impact
Low-privileged or anonymous accounts can enumerate metadata and internal remote URLs of member repositories they do not have direct access to, exposing internal infrastructure details useful for follow-on attacks.
Affected Products
- Sonatype Nexus Repository 3
- Group repositories exposing member repositories via the REST API
- Proxy repositories configured with internal remote URLs
Discovery Timeline
- 2026-09-02 - CVE-2026-77122 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-77122
Vulnerability Analysis
The flaw resides in the repository details REST endpoint GET /service/rest/v1/repositories/{repositoryName}. Nexus Repository 3 allows administrators to define group repositories that aggregate multiple member repositories. Access control is expected to be enforced per repository. In vulnerable versions, the endpoint enforces authorization based on the requested repository name path parameter but does not validate that the caller has direct permission on that specific target. A user granted read or browse permission on the parent group can substitute the name of any member repository into the URL and receive its full configuration metadata. For proxy repositories, that metadata includes the remoteUrl field, disclosing upstream hostnames that may point to internal artifact mirrors, private registries, or vendor infrastructure.
Root Cause
The root cause is broken access control. The endpoint treats membership in a group as sufficient authorization to read the individual members. It should perform an independent permission check against the specific repository named in the request. Because the anonymous role can inherit browse permission in many default deployments, the same bypass extends to unauthenticated attackers depending on configuration.
Attack Vector
Exploitation is network based and requires only low privileges. An attacker with a valid account holding read or browse permission on any group repository, or anonymous access where that permission has been granted, issues a direct HTTP GET to /service/rest/v1/repositories/<member-repository-name>. The server returns the member repository configuration, including remoteUrl values for proxy repositories. See the Sonatype Support Article for vendor technical detail.
Detection Methods for CVE-2026-77122
Indicators of Compromise
- Unexpected GET /service/rest/v1/repositories/{repositoryName} requests from low-privileged accounts targeting repositories outside their assigned scope.
- Sequential enumeration patterns across multiple repository names from a single session or IP address.
- Requests to the endpoint originating from the anonymous user token or unauthenticated sessions.
Detection Strategies
- Review Nexus Repository access logs for REST API calls to /service/rest/v1/repositories/ and correlate the requested repository name with the caller's assigned permissions.
- Flag requests where the caller holds only group-level permissions but queries specific member repository names.
- Alert on anonymous requests to the repositories detail endpoint in installations where anonymous access is not intended.
Monitoring Recommendations
- Forward Nexus Repository application and access logs to a centralized log platform for long-term retention and correlation.
- Baseline normal REST API usage per service account and alert on deviations, including repository enumeration bursts.
- Monitor egress DNS and network telemetry for lookups matching internal hostnames that may have been leaked through the remoteUrl field.
How to Mitigate CVE-2026-77122
Immediate Actions Required
- Upgrade Sonatype Nexus Repository 3 to the fixed release documented in the Sonatype Nexus 3.96.0 Release Notes.
- Review whether the anonymous user has been granted read or browse permission on any group repository and remove it if not required.
- Audit role assignments to ensure users only receive permissions on the specific repositories they need.
Patch Information
Sonatype has addressed the authorization flaw in Nexus Repository 3. Refer to the Sonatype Nexus 3.96.0 Release Notes and the Sonatype Support Article for version details and upgrade guidance.
Workarounds
- Disable anonymous access to Nexus Repository if it is not operationally required.
- Remove read and browse permissions on group repositories from roles that do not need aggregate access.
- Restrict REST API access at the network layer to trusted CI/CD hosts and administrator workstations while planning the upgrade.
- Rotate or obscure internal upstream URLs referenced in proxy repository configurations if exposure is suspected.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
