Description
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.2.0 – < 3.96.0 | 3.96.0 |
Advisories 1
- WID-SEC-2026-3171 Sonatype Nexus Repository Manager: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 2, 2026