Sonatype Nexus Security Advisory
Date: September 2, 2026
Affected Versions: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.21.2 up to and including 3.95.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.96.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = 7.5 (High)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-77124
Summary
Nexus Repository 3’s script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled before running a stored script. As a result, an account holding the script-execution permission could continue running previously created scripts even after an administrator set nexus.scripts.allowCreation to false, undermining the expectation that this setting fully blocks script execution. This issue only affects instances where the Script API had previously been enabled and one or more scripts had already been created.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.96.0 or later. Downloads are available at https://help.sonatype.com/en/download.html.
Immediate Mitigation Options
If you are unable to upgrade immediately:
- Confirm
nexus.scripts.allowCreationis set tofalse(the default). - If the Script API was ever enabled, delete all stored scripts via
DELETE /service/rest/v1/script/{name}and verify the health check reports that scripting is disabled.
Credit
This issue was discovered and reported responsibly by Yousif (s3c_krd) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An account holding script-execution permission could continue running previously-created Groovy scripts even after an administrator disabled the Script API, allowing continued script execution against the affected Nexus Repository instance.
Q: What preconditions must be met in order to be vulnerable?
A: The instance must have had nexus.scripts.allowCreation enabled at some point, with at least one script created via the Script API, and the account must hold the nexus:script:*:run permission — a privileged permission not granted by default.
Q: Are there implications associated with this advisory itself?
A: As with any public vulnerability disclosure, publishing this information could help a malicious actor develop an exploit. We strongly encourage all users to assess their exposure and apply the recommended fix or mitigation as soon as possible.
Q: Why is Sonatype making this information available?
A: Sonatype is committed to responsible disclosure. We proactively notify our community of security issues that affect our products so that users can take appropriate action to protect their systems.