SB2026090751 - Multiple vulnerabilities in Nexus Repository Manager

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090751

SB2026090751 - Multiple vulnerabilities in Nexus Repository Manager

Published: September 7, 2026

Security Bulletin ID SB2026090751
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-77124)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute previously created scripts.

The vulnerability exists due to an incomplete list of disallowed inputs in the script execution endpoint when processing requests to run stored scripts after script execution has been disabled. A remote privileged user can invoke the script execution endpoint to execute previously created scripts.

Only instances where the Script API was previously enabled and stored scripts already exist are affected.


2) Incorrect authorization (CVE-ID: CVE-2026-77125)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify blobstore configuration without authorization.

The vulnerability exists due to incorrect authorization in blobstore group management REST API endpoints when handling requests to convert an existing blobstore into a group blobstore. A remote user can invoke the endpoints with only the nexus:blobstores:create permission to modify blobstore configuration without authorization.


3) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-77123)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose a webhook shared secret.

The vulnerability exists due to insertion of sensitive information into sent data in the capability read API when handling capability read requests. A remote user can query the API to retrieve a plaintext shared secret configured on a webhook capability.

Exploitation requires the nexus:capabilities:read privilege and a webhook capability configured with a shared secret.


4) Incorrect authorization (CVE-ID: CVE-2026-77122)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose member repository metadata.

The vulnerability exists due to incorrect authorization in the repository details REST API endpoint when requesting details directly for a member repository. A remote user can request the endpoint for a member repository to disclose its metadata.

Exploitation requires read or browse permission on a group repository containing the target member repository and knowledge of the member repository name. For proxy repositories, disclosed metadata includes the configured remote URL.


Remediation

Install update from vendor's website.

References