CVE-2026-7494 | Nexus Repository 3 is vulnerable to Server-Side Request Forg… | CVSS 5.3 MEDIUM

Description

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.

Metadata

CVE ID: CVE-2026-7494
State: PUBLISHED
Assigner: Sonatype
Reserved: 2026-04-30 12:15 UTC
Published: 2026-07-14 15:46 UTC
Last updated: 2026-07-14 17:12 UTC
Primary CWE: CWE-918
CWE-918 Server-Side Request Forgery (SSRF)
Vendor / Product: Sonatype / Nexus Repository
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Sonatype	Nexus Repository	—	3.0.0 < 3.94.0

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	CWE-918 Server-Side Request Forgery (SSRF)

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

References (2)