CVE-2026-77123: Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nexus Repository 3to a version that resolves this vulnerability.Fixed in 3.96.0
Event History
Frequently Asked Questions
Which users can retrieve webhook shared secrets?
Any account granted the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability.
Are webhook secrets exposed by default?
Exposure requires both a configured webhook capability with a shared secret and an account holding the nexus:capabilities:read privilege. The issue is in the capability read API response, where the secret should have been masked.
What should be done if an affected instance cannot be upgraded immediately?
Restrict the nexus:capabilities:read privilege to only trusted accounts and treat configured webhook shared secrets as potentially disclosed. Rotate webhook shared secrets where possible.
How can administrators determine whether they are affected?
Instances running Nexus Repository 3 versions 3.2.0 through 3.95.x are affected. Check whether webhook capabilities are configured with shared secrets and whether any accounts have the nexus:capabilities:read privilege.