Sonatype Nexus Repository 3: Five Auth Bypass and Info Disclosure CVEs Disclosed Together
Key findings • Two High and three Medium severity vulnerabilities disclosed in Sonatype Nexus Repository 3 on September 2, 2026. • Vulnerabilities include authorization bypasses in blobstore …
Key findings
- Two High and three Medium severity vulnerabilities disclosed in Sonatype Nexus Repository 3 on September 2, 2026.
- Vulnerabilities include authorization bypasses in blobstore management and script execution.
- Sensitive information disclosure allows retrieval of webhook shared secrets.
- Repository metadata access flaws and a component listing denial-of-service issue were also found.
- Prompt patching and review of Nexus Repository 3 instances are recommended.
On September 2, 2026, Sonatype disclosed five vulnerabilities affecting Nexus Repository 3, with two rated High and three Medium. These vulnerabilities primarily revolve around authorization flaws and sensitive information disclosure within the platform's REST API and management functionalities. The coordinated disclosure highlights potential risks for organizations relying on Nexus Repository 3 for artifact management.
Two of the High severity vulnerabilities, CVE-2026-77125 and CVE-2026-77124, stem from improper authorization checks. CVE-2026-77125 involves two blobstore group management REST API endpoints that could be invoked by a user with limited permissions (nexus:blobstores:create) to convert an existing blobstore into a group blobstore. CVE-2026-77124 concerns the script execution endpoint, which failed to check if script execution was administratively disabled, allowing users with script-execution permission to run scripts even after an administrator attempted to disable them.
The Medium severity vulnerabilities also touch upon authorization and information disclosure. CVE-2026-77123 reveals a sensitive information disclosure in the capability read API, where a user with nexus:capabilities:read privilege could retrieve the plaintext shared secret of a webhook capability, which should have been masked. CVE-2026-77122 describes an authorization flaw in the repository details endpoint, allowing users with read or browse permission on a group repository to access metadata of member repositories for which they had no direct permission. Lastly, CVE-2026-77121 details an issue where a user could upload a POM file with an oversized metadata field to a hosted Maven repository, causing permanent failure in listing or browsing components of that repository until an administrator intervenes.
The impact of these vulnerabilities ranges from unauthorized modification of blobstore configurations and continued script execution to the exposure of sensitive secrets and repository metadata. CVE-2026-77121 presents a denial-of-service risk to specific repositories. Users are advised to consult Sonatype's security advisories for specific version information and remediation steps. As these vulnerabilities were disclosed simultaneously, it is crucial for administrators to review their Nexus Repository 3 instances and apply necessary updates or mitigations promptly to prevent potential exploitation.
Given the nature of these authorization and information disclosure flaws, prompt patching and configuration review are essential to maintain the security and integrity of artifact repositories managed by Sonatype Nexus Repository 3.