CVE-2026-0600

Medium

Description

Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

SeverityMedium

CVSS6.2

Exploit probability—

ProductSonatype Nexus Repository Manager

PublishedJan 14, 2026

First seenJan 14, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Vendor advisories

support.sonatype.com/hc/en-us/articles/47928855816595

Affected products

Product	Affected versions	Fixed in
sonatype nexus_repository_manager	3.0.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.