CVE-2026-77123 Sonatype CVE debrief

Who should care

Defenders managing Nexus Repository Manager 3 deployments, especially those with webhook capabilities configured, should assess exposure and prioritize remediation. This includes reviewing the current configuration, identifying potential vulnerabilities, and taking steps to mitigate the risk. Additionally, defenders should verify exposure in Nexus Repository Manager 3 deployments with webhook capabilities configured and assess the need for compensating.

Why it matters

CVE-2026-77123 is a sensitive information disclosure vulnerability in Nexus Repository 3 that allows an account with the nexus:capabilities:read privilege to retrieve the plaintext shared secret configured on a webhook capability. Defenders managing Nexus Repository Manager 3 deployments, especially those with webhook capabilities configured, should assess exposure and prioritize remediation.

• Verify exposure in Nexus Repository Manager 3 deployments with webhook capabilities configured
• Assess the need for compensating controls to protect sensitive information
• Prioritize remediation for affected versions 3.2.0 through 3.95.x
• Update to version 3.96.0 or later to prevent sensitive information disclosure

Technical summary

The CVE-2026-77123 vulnerability in Nexus Repository 3 allows an account with the nexus:capabilities:read privilege to retrieve the plaintext shared secret configured on a webhook capability. This issue affects versions 3.2.0 through 3.95.x and is fixed in version 3.96.0. The vulnerability is a sensitive information disclosure issue that can be exploited by an attacker with the required privileges. Defenders should prioritize verifying exposure in Nexus Repository Manager 3 deployments, especially those with webhook capabilities configured, and assess the need for compensating controls.

Defensive priority

Defenders should prioritize verifying exposure in Nexus Repository Manager 3 deployments, especially those with webhook capabilities configured, and assess the need for compensating controls.

Recommended defensive actions

• Verify exposure in Nexus Repository Manager 3 deployments, especially those with webhook capabilities configured
• Assess the need for compensating controls
• Inventory and prioritize remediation for affected versions 3.2.0 through 3.95.x
• Update to version 3.96.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the sensitive information disclosure vulnerability in Nexus Repository 3. The vulnerability allows an account with the nexus:capabilities:read privilege to retrieve the plaintext shared secret configured on a webhook capability. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x and is fixed in version 3.96.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.