CVE-2026-14645 Sonatype CVE debrief

Who should care

Defenders responsible for configuring and securing Nexus Repository 3 should assess their exposure and verify the configuration of the Webhook: Global capability. They should also ensure that the Capability Administration permission is only granted to trusted users to prevent unauthorized access. Additionally, defenders should monitor server requests to detect potential SSRF attacks and respond promptly.

Why it matters

CVE-2026-14645 is a Server-Side Request Forgery (SSRF) vulnerability in Nexus Repository 3, which allows an attacker with the Capability Administration permission to cause the server to send requests to internal network locations. Defenders should prioritize verifying the configuration of the Webhook: Global capability and ensuring that the Capability Administration permission is only granted to trusted users.

• Verify configuration of the Webhook: Global capability to prevent SSRF attacks
• Ensure that the Capability Administration permission is only granted to trusted users to prevent unauthorized access
• Monitor server requests to detect potential SSRF attacks and respond promptly

Technical summary

The vulnerability exists in the Webhook: Global capability of Nexus Repository 3, which does not validate the destination of the configured URL before making an outbound HTTP request. This allows an attacker with the Capability Administration permission to cause the server to send requests to internal network locations. The permission can be granted by role assignment, independent of authentication status. As a result, an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM.

Defensive priority

Defenders should prioritize verifying the configuration of the Webhook: Global capability and ensuring that the Capability Administration permission is only granted to trusted users.

Recommended defensive actions

• Verify the configuration of the Webhook: Global capability
• Ensure that the Capability Administration permission is only granted to trusted users
• Monitor server requests to detect potential SSRF attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability, including its description, CVSS score, and affected versions. The vulnerability exists in Nexus Repository 3, which does not validate the destination of the configured URL before making an outbound HTTP request. This allows an attacker with the Capability Administration permission to cause the server to send requests to internal network locations. Evidence is limited to public CVE and NVD information. Defenders should verify the configuration

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.