JVN#64861120    
Sonatype Nexus Repository vulnerable to server-side request forgery

Nexus Repository provided by Sonatype is vulnerable to server-side request forgery.

• Nexus Repository, 3.0.0 and later versions (both Community Edition and Professional Edition are affected)

Nexus Repository provided by Sonatype contains the following vulnerability.

• Server-side request forgery (CWE-918)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N Base Score 6.2
  • CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N Base Score 7.6
  • CVE-2026-0600

The remote storage URL can be configured to point to some network destination, such as cloud meta data services or inside the local networks, which are not expected to be accessed from the product.

Update and Configure the Software Appropriately
The version 3.88.0 introduces optional URL validation functionality.
Update the software to version 3.88.0 or later, and configure this URL validation properly.
For more information, refer to the information provided by the developer.

Vendor	Link
Sonatype, Inc.	CVE-2026-0600 Nexus Repository 3 - Server-Side Request Forgery - 2026-01-13
	Sonatype Nexus Repository 3.88.0 Release Notes / New URL Validation to Protect Against Private Network Access
	Securing Nexus Repository

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.