CVE-2026-77123 Overview
CVE-2026-77123 is a sensitive information disclosure vulnerability in Sonatype Nexus Repository 3. The capability read API returns the plaintext shared secret configured on a webhook capability, which the platform is supposed to mask in all API responses. Any authenticated account holding the nexus:capabilities:read privilege can retrieve the secret. The issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x and is fixed in version 3.96.0. The weakness is categorized as CWE-201: Insertion of Sensitive Information Into Sent Data.
Critical Impact
Low-privileged operators with capability read access can extract webhook shared secrets, enabling them to forge signed webhook payloads to downstream systems.
Affected Products
- Sonatype Nexus Repository 3, versions 3.2.0 through 3.95.x
- Webhook capability configurations that use shared secrets for payload signing
- API consumers relying on the capability read endpoint for configuration inspection
Discovery Timeline
- 2026-09-02 - CVE-2026-77123 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-77123
Vulnerability Analysis
Nexus Repository 3 exposes an administrative API that lists and describes configured capabilities, including webhooks. Webhook capabilities include a shared secret used to compute an HMAC signature on outbound event payloads. This secret should be treated like a password and masked in all API responses. The capability read API instead returns the secret in cleartext to callers with the nexus:capabilities:read privilege. That privilege is normally granted to operators who need visibility into configuration, not to holders of the webhook secret itself. The disclosure breaks the trust boundary between read-only configuration visibility and secret material access.
Root Cause
The root cause is missing output filtering on the capability read endpoint. Fields flagged as secret in the capability schema are not redacted before serialization. The fix in version 3.96.0 masks the shared secret in API responses so it is no longer returned to callers, regardless of privilege level.
Attack Vector
An attacker requires network access to the Nexus Repository API and an authenticated account with the nexus:capabilities:read privilege. The attacker calls the capability read API against a webhook capability identifier and parses the returned JSON for the shared secret field. With the recovered secret, the attacker can generate valid HMAC signatures for arbitrary webhook payloads. Downstream systems that validate signatures alone will accept forged events, enabling data injection into CI/CD pipelines, chat platforms, or custom automation that trusts Nexus webhook traffic.
No verified public exploit code is available. See the Sonatype Support Article and the Sonatype Nexus 3.96 Release Notes for vendor detail.
Detection Methods for CVE-2026-77123
Indicators of Compromise
- API access log entries showing GET requests to the capability read endpoint (paths under /service/rest/v1/capabilities or the internal capabilities API) issued by non-administrator accounts.
- Repeated capability read requests from a single account enumerating capability identifiers in sequence.
- Webhook deliveries with valid HMAC signatures arriving from unexpected source IPs or at unexpected times.
Detection Strategies
- Audit Nexus access logs for accounts holding nexus:capabilities:read and correlate their read requests against operational need.
- Compare downstream webhook consumer logs with Nexus webhook emission logs to identify signed events with no matching Nexus source event.
- Review role and privilege assignments to enumerate every account that could invoke the vulnerable endpoint prior to patching.
Monitoring Recommendations
- Enable request auditing on the Nexus REST API and forward logs to a centralized analytics platform for retention and querying.
- Alert on any non-service account reading capability configurations, especially outside change windows.
- Track webhook signature verification failures on receiving systems, since forged and legitimate traffic may coexist during rotation.
How to Mitigate CVE-2026-77123
Immediate Actions Required
- Upgrade Nexus Repository 3 to version 3.96.0 or later, which masks shared secrets in capability API responses.
- Rotate every webhook shared secret configured on affected instances, since prior values must be considered exposed to any holder of nexus:capabilities:read.
- Review and reduce assignment of the nexus:capabilities:read privilege to the minimum set of operational accounts.
Patch Information
Sonatype fixed the disclosure in Nexus Repository 3 version 3.96.0. Details are documented in the Sonatype Nexus 3.96 Release Notes and the Sonatype Support Article. Apply the upgrade before rotating secrets so that new values are not disclosed by the still-vulnerable endpoint.
Workarounds
- Restrict the nexus:capabilities:read privilege to administrative accounts until the upgrade is complete.
- Place the Nexus administrative API behind a network policy that limits access to trusted management subnets.
- Require additional verification on webhook consumers, such as source IP allowlists or mutual TLS, so signature knowledge alone does not authorize payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
