Sonatype Nexus Security Advisory
Date: September 2, 2026
Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.2.0 up to and including 3.95.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.96.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N = 6.0 (Medium)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-77123
Summary
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.96.0 or later. The latest release is available at https://help.sonatype.com/en/download.html.
As a precaution, consider rotating any configured webhook shared secrets after upgrading, particularly if the nexus:capabilities:read privilege has been delegated to accounts other than trusted administrators.
Immediate Mitigation Options
Until upgraded, review which roles and accounts hold the nexus:capabilities:read privilege and restrict it to trusted administrative accounts. Where feasible, avoid configuring webhook shared secrets on instances where this privilege is broadly delegated.
Credit
This issue was discovered and reported responsibly by Beni Saprulah (HackerOne: https://hackerone.com/bebensap, LinkedIn: https://www.linkedin.com/in/beni-saprulah) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker with only read-only capability-inspection access can obtain the plaintext shared secret configured on a webhook capability, which is intended to remain confidential and is not otherwise exposed through any sanctioned read path.
Q: What preconditions must be met in order to be vulnerable?
A: An account holding the nexus:capabilities:read privilege, and a webhook capability (global or repository) configured with a shared secret. No user interaction beyond a single API call is required.
Q: Are there implications associated with this advisory itself?
A: As with any public vulnerability disclosure, publishing details could help a malicious actor construct an exploit before all affected instances are patched. Sonatype recommends assessing your exposure and upgrading or applying mitigations promptly.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies customers of security issues so they can take timely action to protect their environments.