CVE-2026-14646

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 (affected versions not specified)

Description Nexus Repository 3 fails to apply Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Users with read access to a proxy repository backed by a compromised or attacker-controlled upstream server can receive responses from internal network addresses or cloud metadata endpoints, which may expose sensitive data such as cloud IAM credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.