Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: All previous Sonatype Nexus Repository 3 CE/Pro versions up to and including 3.94.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N = 5.1 (Medium)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17597
Summary
Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server’s response could be used to infer whether internal hosts and ports are reachable.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Immediate Mitigation Options
Restrict the nexus:settings:update permission to trusted administrators only. Where feasible, apply network-level egress controls to limit outbound connections from the Nexus Repository host to internal/restricted network ranges.
Credit
This issue was discovered and reported responsibly by Sanjok Karki (@thesanjok) of National Forensic Sciences University, Goa, via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker with the required permission could cause the Nexus Repository server to make outbound connection attempts to arbitrary internal or external hosts and ports, and use response/timing differences to determine whether those hosts and ports are reachable (network reconnaissance). No data is directly exposed and no configuration is permanently modified by this action alone.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must hold an account with the nexus:settings:update permission, which by default is limited to administrators.
Q: Are there implications associated with this advisory itself?
A: As with any vulnerability disclosure, publishing details could theoretically assist an attacker in exploiting unpatched systems. Sonatype follows responsible disclosure practices, coordinating with the reporter and providing a fixed version prior to publication, and recommends applying the fix promptly to minimize exposure.
Q: Why is Sonatype making this information available?
A: Sonatype is committed to transparency and responsible disclosure. Making this information available allows users to assess their exposure and take appropriate action to protect their systems.