CVE-2026-77124: Nexus Repository 3 Auth Bypass Vulnerability

CVE-2026-77124 Overview

CVE-2026-77124 affects Sonatype Nexus Repository 3, where the script execution endpoint fails to honor the administrative kill switch for script execution. The endpoint POST /service/rest/v1/script/{name}/run does not check whether script execution has been disabled through the nexus.scripts.allowCreation=false configuration setting. An authenticated account holding script-execution permission can continue running previously-created scripts, even after an administrator disables the feature. This weakness maps to [CWE-184: Incomplete List of Disallowed Inputs], where a security control fails to enforce its intended restriction across all execution paths.

Critical Impact
Authenticated users with script-execution privileges can bypass the administrative safeguard intended to fully block script execution in Nexus Repository 3.

Affected Products

Sonatype Nexus Repository 3 (versions prior to 3.96.0)
Deployments relying on nexus.scripts.allowCreation=false as a mitigation
Instances exposing the REST script execution API to privileged accounts

Discovery Timeline

2026-09-02 - CVE-2026-77124 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-77124

Vulnerability Analysis

Nexus Repository 3 exposes a Groovy scripting REST API that allows privileged administrators to upload and run scripts against the server. To reduce the attack surface, Sonatype provides the nexus.scripts.allowCreation configuration flag. Setting this flag to false is documented as a hardening step to prevent script execution.

The defect resides in the run endpoint at POST /service/rest/v1/script/{name}/run. The endpoint validates the requester's script-execution permission but does not consult the nexus.scripts.allowCreation flag before dispatching execution. As a result, any script that already exists on the server can still be invoked after administrators believe scripting has been fully disabled.

Because Nexus scripts typically execute arbitrary Groovy against the JVM hosting the repository, successful invocation can yield full application-level compromise, including manipulation of repositories, artifacts, and credentials.

Root Cause

The root cause is an incomplete enforcement check. The administrative setting was designed as a broad kill switch, but the run pathway inspects only permission grants, not the runtime configuration flag. This produces a gap between the documented security control and its actual enforcement surface.

Attack Vector

Exploitation requires network access to the Nexus REST API and an account already holding script-execution permission. The attacker issues an HTTP POST to /service/rest/v1/script/{name}/run referencing a script that was created before the administrator set nexus.scripts.allowCreation=false. The server executes the stored script despite the disabled state. No user interaction is required.

Refer to the Sonatype Nexus 3.96 Release Notes and the Sonatype Support Article for vendor-supplied technical detail.

Detection Methods for CVE-2026-77124

Indicators of Compromise

HTTP POST requests to /service/rest/v1/script/{name}/run observed after nexus.scripts.allowCreation was set to false.
Unexpected Groovy script executions recorded in Nexus audit logs by non-administrator service accounts.
Spawning of child processes or outbound network connections originating from the Nexus JVM around the time of script API calls.

Detection Strategies

Correlate Nexus access logs with configuration changes to flag any script/*/run invocation occurring after the allowCreation flag is disabled.
Enumerate persisted scripts on affected servers and compare against an approved allowlist to identify residual scripts that remain executable.
Alert on any authentication event that assigns or uses the nx-script-* permissions in production environments.

Monitoring Recommendations

Ingest Nexus Repository application and access logs into a centralized analytics platform for API-path monitoring.
Track process lineage under the Nexus service account to detect anomalous child processes indicative of Groovy execution.
Baseline normal REST API usage patterns and alert on deviations targeting the /service/rest/v1/script/ prefix.

How to Mitigate CVE-2026-77124

Immediate Actions Required

Upgrade Nexus Repository 3 to version 3.96.0 or later, which corrects the enforcement gap.
Audit and remove any stored scripts that are not explicitly required for operations.
Rotate credentials for accounts that hold script-execution privileges if unexpected run calls appear in logs.
Restrict network access to the Nexus REST API to trusted management networks only.

Patch Information

Sonatype addressed the issue in Nexus Repository 3.96.0. The fix ensures the run endpoint honors the nexus.scripts.allowCreation configuration state. Consult the Sonatype Nexus 3.96 Release Notes and the Sonatype Support Article for upgrade procedures and version details.

Workarounds

Revoke the nx-script-* privileges from all roles that do not require them, effectively removing the precondition for exploitation.
Delete existing stored scripts so no previously-created payloads remain callable through the run endpoint.
Place the Nexus administrative API behind a reverse proxy that blocks requests to /service/rest/v1/script/ for non-administrative sources.

bash

# Configuration example: block the vulnerable endpoint at a reverse proxy
location ~* ^/service/rest/v1/script/ {
    deny all;
    return 403;
}