CVE-2026-14646 Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect

Medium 4.9 Published 14 Jul 2026 Updated 15 Jul 2026

Attackers with read access can exploit SSRF via HTTP redirects to access internal network resources or cloud metadata, potentially exposing sensitive credentials.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-14646?

CVE-2026-14646 is a medium-severity server-side request forgery vulnerability in Sonatype Nexus Repository Manager, published on 14 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

Weakness: CWE-918

Which versions are affected by CVE-2026-14646?

It affects 1 product.

Products include Sonatype Nexus Repository Manager.

How do I fix CVE-2026-14646?

No fix has been published for CVE-2026-14646 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-14646 being exploited?

There is no known exploitation of CVE-2026-14646 in the wild and no public exploit code.

All Sonatype Nexus Repository Manager vulnerabilities

Sources

Also known as GHSA-jxph-5989-pgpj.