Sonatype Nexus Repository Manager

Nexus Repository Manager 3: RM Code Exec via Unvalidated Realm IDs
CVE-2026-17593 7.2 - High - August 07, 2026

An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.

Reflection Injection

Nexus Repository 3 Privilege Escalation via REST Privileges API Type-Confusion
CVE-2026-14644 8.6 - High - August 07, 2026

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

Object Type Confusion

Sonatype Nexus Repo 3 Config Overwrite via Task Properties
CVE-2026-17598 5.3 - Medium - August 07, 2026

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.

Mass Assignment

Nexus Repo 3 XSS via Storing Blob Store Name (fixed in 3.95.0)
CVE-2026-17596 6.3 - Medium - August 07, 2026

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.

XSS

Nexus Repository 3 JEXL Sandbox Bypass Exposes JVM Class Metadata
CVE-2026-17595 5.3 - Medium - August 07, 2026

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This issue does not permit method invocation, object construction, or arbitrary code execution. This has been fixed by restricting property access in the JEXL sandbox to the intended data types.

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Nexus Repository 3 <=3.94.x: repo-creation privilege escalation
CVE-2026-17594 8.2 - High - August 07, 2026

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

AuthZ

Nexus Repository 3: HikariCP Connection Property RCE via DataStore API
CVE-2026-17603 8.7 - High - August 07, 2026

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

Code Injection

Privilege Escalation via Wildcard Privilege Tampering in Nexus Repo
CVE-2026-17601 8.9 - High - August 07, 2026

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment.

AuthZ

Sonatype Nexus Repo 3 Session Persistence on Account Deletion
CVE-2026-17600 8.7 - High - August 07, 2026

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

Insufficient Session Expiration

Unprotected Admin Password Reset Endpoint in Nexus Repository 3
CVE-2026-17599 6.9 - Medium - August 07, 2026

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.

Unverified Password Change

Nexus Repository 3 SSRF via Email Config (3.94.1, fixed 3.95.0)
CVE-2026-17597 5.1 - Medium - August 07, 2026

Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server's response could be used to infer whether internal hosts and ports are reachable. This issue affects Nexus Repository 3 CE/Pro versions up to and including 3.94.1, and is fixed in version 3.95.0.

SSRF

Nexus Repository 3 SSRF via Unfiltered HTTP Redirect Targets
CVE-2026-14646 - July 14, 2026

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server including an anonymous user, if anonymous access is enabled could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

SSRF

Nexus Repository 3 SSRF via Webhook: Global URL
CVE-2026-14645 - July 14, 2026

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.

SSRF

Auth Bypass: Nexus Repository 3 Upload API
CVE-2026-14504 - July 14, 2026

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.

AuthZ

Nexus Repository SSRF via SSL Cert Retrieval (v3<3.94)
CVE-2026-7494 - July 14, 2026

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.

SSRF

Unauthorized Access via API Key Generation in Sonatype Nexus Repo Manager
CVE-2026-11403 - July 14, 2026

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) must be enabled and the targeted user must have an active API key for this vulnerability to be exploitable.

Insufficient Entropy

Nexus Repo Manager <=3.92: proxy creds disclosure via auth bypass
CVE-2026-10741 - June 17, 2026

Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.

AuthZ

NX-Licensing upload RCE in Sonatype Nexus Repository <3.92.0
CVE-2026-10748 - June 16, 2026

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

Marshaling, Unmarshaling

Credential-guessing via authenticated endpoints in Sonatype Nexus Repository
CVE-2026-3329 - June 11, 2026

A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

Improper Restriction of Excessive Authentication Attempts

XSS via Repository HTML Index in Nexus Repository 3.6.0-3.92.0
CVE-2026-7308 - May 11, 2026

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

XSS

Server-Side Connection Initiation in Nexus Repository Manager 3.x via LDAP Admin
CVE-2026-3048 - May 11, 2026

An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

Marshaling, Unmarshaling

Hard-Coded Credentials in Nexus Repository Manager 3.0.0-3.70.5 Allow Unauth OS Cmds
CVE-2026-5189 - April 15, 2026

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

Use of Hard-coded Credentials

Sonatype Nexus 3.22.1-3.90.2 Task Exec perm bypassing nexus.scripts.allowCreation
CVE-2026-3199 - April 08, 2026

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

Marshaling, Unmarshaling

Reflected XSS in Sonatype Nexus Repo 3.0.0-3.90.2 via Craft URL
CVE-2026-3438 - April 08, 2026

A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.

XSS

Nexus Repository 3 SSRF via Proxy Repo URL (v3.0.0+; fixed 3.88.0+)
CVE-2026-0600 - January 14, 2026

Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

SSRF

CVE-2026-0601: Reflected XSS in Nexus Repository 3 via Unsanitized Input
CVE-2026-0601 - January 14, 2026

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.

XSS

Sonatype Nexus Repo 3.83.0: XSS from missing security header
CVE-2025-13488 - December 04, 2025

Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.

XSS

SSRF in Sonatype Nexus Repository 2.15.2 Remote Browser Plugin
CVE-2025-9868 - October 08, 2025

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.

SSRF

Sonatype Nexus Repository Manager 3.x before 3.38.0
CVE-2022-27907 4.3 - Medium - March 30, 2022

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.

SSRF

Sonatype Nexus Repository Manager 3.36.0
CVE-2021-43961 4.3 - Medium - March 17, 2022

Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.

XSS

Sonatype Nexus Repository Manager 3.x before 3.36.0
CVE-2021-43293 4.3 - Medium - November 04, 2021

Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Server Side Request Forgery (SSRF).

SSRF

Sonatype Nexus Repository Manager 3.x through 3.35.0
CVE-2021-42568 4.3 - Medium - November 02, 2021

Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account.

Information Disclosure

Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0
CVE-2021-37152 5.4 - Medium - August 10, 2021

Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Managers pages with code modifications.

XSS

Sonatype Nexus Repository Manager 3.x before 3.31.0
CVE-2021-34553 4.3 - Medium - June 18, 2021

Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.

Directory traversal

A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1
CVE-2021-29159 6.1 - Medium - April 28, 2021

A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of the NXRM application.

XSS

Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories
CVE-2021-30635 5.3 - Medium - April 27, 2021

Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed).

Directory traversal

Sonatype Nexus Repository Manager 3.x before 3.29.0
CVE-2020-29436 6.5 - Medium - December 17, 2020

Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.

XXE

A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19
CVE-2020-15012 8.6 - High - October 12, 2020

A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to).

Directory traversal

An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1
CVE-2020-11415 - April 27, 2020

An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.

There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475)
CVE-2019-15588 7.2 - High - November 01, 2019

There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.

Shell injection

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19
CVE-2019-16530 7.2 - High - October 21, 2019

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.

Unrestricted File Upload

Sonatype Nexus Repository Manager 2.x before 2.14.15
CVE-2019-15893 7.2 - High - October 16, 2019

Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data
CVE-2019-5475 8.8 - High - September 03, 2019

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.

Shell injection

In Nexus Repository Manager before 3.18.0, users with elevated privileges
CVE-2019-14469 - August 22, 2019

In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.

Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.
CVE-2019-9630 - July 08, 2019

Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.

Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).
CVE-2019-9629 - July 08, 2019

Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).

Sonatype Nexus Repository Manager 2.x before 2.14.13
CVE-2019-11629 6.1 - Medium - May 07, 2019

Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.

XSS

Sonatype Nexus Repository Manager before 3.14
CVE-2018-16621 7.2 - High - November 15, 2018

Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.

EL Injection

Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.
CVE-2018-16620 7.5 - High - November 15, 2018

Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.

AuthZ

Sonatype Nexus Repository Manager before 3.14
CVE-2018-16619 6.1 - Medium - November 15, 2018

Sonatype Nexus Repository Manager before 3.14 allows XSS.

XSS