Sonatype Nexus Security Advisory
Date: September 2, 2026
Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.38.0 up to (but not including) 3.96.0
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.96.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N = 5.3 (Medium)
CWE: CWE-863: Incorrect Authorization
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-77122
Summary
A user with read/browse permission on a group repository could retrieve metadata for member repositories on which they held no direct permission, by requesting the repository details REST API endpoint directly for the member repository. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.96.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Immediate Mitigation Options
Customers who cannot upgrade immediately should audit role assignments and avoid granting group-repository read/browse permissions to accounts that should not be able to view metadata (including proxy remote URLs) of the group’s member repositories. Removing or restricting such group-only permissions until the upgrade is applied will prevent exploitation.
Credit
This issue was discovered and reported responsibly by Yousif (s3c_krd) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker who satisfies the required preconditions can retrieve metadata about member repositories that are not directly authorized to them, including repository name, format, type, and, for proxy repositories, the configured remote URL.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must hold read or browse permission on a group repository that contains the target member repository, and must know or be able to determine the name of that member repository (for example, via search results scoped to the group). This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation.
Q: Are there implications associated with this advisory itself?
A: As with any vulnerability disclosure, publishing details could enable bad actors to attempt exploitation against systems that have not yet been updated. Sonatype recommends customers assess their exposure and apply the fixed version or mitigations promptly.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies customers of security issues so they can take appropriate action to protect their systems.