CVE-2026-14645

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 (affected versions not specified)

Description Nexus Repository 3 fails to validate the destination URL configured in the "Webhook: Global" capability before initiating outbound HTTP requests. This allows a user with Capability Administration permissions to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making requests to internal network locations. This action can be triggered by authenticated users with the required role or by unauthenticated users if the anonymous role has been granted the Capability Administration permission.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.