CVE-2026-77122 Sonatype CVE debrief

Who should care

Defenders and administrators of Sonatype Nexus Repository 3 installations should assess exposure and implement compensating controls. This includes verifying affected versions, reviewing repository configurations, and monitoring for potential misuse.

Why it matters

CVE-2026-77122 is a medium-severity vulnerability in Sonatype Nexus Repository 3 that allows accounts with limited permissions to retrieve metadata for repositories without direct access. Defenders should verify affected versions, assess exposure, and implement compensating controls to limit potential metadata exposure and prevent unauthorized access.

• Potential metadata exposure for member repositories
• Possible revelation of internal upstream hostnames for proxy repositories
• Need for verification of affected versions and configurations
• Prioritization of compensating controls and monitoring

Technical summary

The REST API repository details endpoint in Sonatype Nexus Repository 3 has an authorization flaw. Accounts with read or browse permission on a group repository can retrieve metadata for member repositories without direct permission. Disclosed metadata may include configured remote URLs for proxy repositories, potentially revealing internal upstream hostnames. This vulnerability allows accounts with limited permissions to retrieve metadata for repositories without direct access. Defenders should verify affected versions, assess exposure, and implement compensating controls to limit potential metadata exposure and prevent unauthorized access.

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and implementing compensating controls.

Recommended defensive actions

• Verify if the installed version of Sonatype Nexus Repository 3 is affected
• Assess exposure based on repository configurations and user permissions
• Implement compensating controls to limit metadata exposure
• Monitor for potential misuse of the REST API endpoint
• Review repository configurations for potential exposure
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the authorization flaw in Sonatype Nexus Repository 3. The flaw allows accounts with read or browse permission on a group repository to retrieve metadata for member repositories without direct permission.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.