Skip to content
OpenAdvisories
Medium WID-SEC-2026-3171 5 CVEs

Sonatype Nexus Repository Manager: Mehrere Schwachstellen ermöglichen Denial of Service

Published Sep 2, 2026 · Updated Sep 2, 2026 · de-DE

Vendor: Sonatype Product: Nexus Repository Manager Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Sonatype Nexus Repository Manager ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen, Code auszuführen oder Sicherheitsmaßnahmen zu umgehen.

Product

Sonatype Nexus Repository Manager ist ein Verwaltungstool für Software-Bestandteile.

Vulnerabilities 5

  • High 7.5
    CVE-2026-77124

    Nexus Repository 3 - Script Execution Disable Setting Not Enforced

    In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to ru…

    Sonatype Nexus Repository 3
  • High 7.1
    CVE-2026-77125

    Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints

    A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these …

    Sonatype Nexus Repository 3
  • Medium 6.0
    CVE-2026-77123

    Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API

    Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to…

    Sonatype Nexus Repository 3
  • Medium 5.3
    CVE-2026-77121

    Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields

    A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrat…

    Sonatype Nexus Repository 3
  • Medium 5.3
    CVE-2026-77122

    Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions

    An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member re…

    Sonatype Nexus Repository 3

Revision history

  1. #1

    Initiale Fassung

References