CVE-2026-14645: Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability
Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure Nexus Repository 3 validates the destination of the "Webhook: Global" capability's configured URL before making any outbound HTTP request (so it cannot target internal network locations).
Nexus Repository 3 (Webhook: Global capability) Configured URL destination validation (enable/disable SSRF-safe behavior) = Must validate destination URLs before outbound requests
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14645?
CVE-2026-14645 has a risk rating of 45.
How do I fix CVE-2026-14645?
To fix CVE-2026-14645, ensure that Webhook URLs are properly validated before sending requests.
Who is affected by CVE-2026-14645?
CVE-2026-14645 affects users of Sonatype Nexus Repository 3 with Capability Administration permissions.
What type of vulnerability is CVE-2026-14645?
CVE-2026-14645 is categorized as a Server-Side Request Forgery (SSRF) vulnerability.
What can an attacker do with CVE-2026-14645?
An attacker can exploit CVE-2026-14645 to make the server send requests to internal network locations.