CVE Explorer

CVE-2026-0600

Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:0b651d039b64c1a7c61ca61c4033b2c68a20ac90356da4c0c3b85968c4524741

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"cpes":["cpe:2.3:a:sonatype:nexus_repository_manager:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.0.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.0.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.3.2:*:*:*:*:*:*:…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:574b6505b7dd6d119064698d9b5d2776bc58acbd18ec46c691d1929c00754ade · sha256:172fe2d4e99bff07… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.2,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:574b6505b7dd6d119064698d9b5d2776bc58acbd18ec46c691d1929c00754ade · sha256:172fe2d4e99bff07… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:574b6505b7dd6d119064698d9b5d2776bc58acbd18ec46c691d1929c00754ade · sha256:172fe2d4e99bff07… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"tags":["vendor-advisory"],"url":"https://support.sonatype.com/hc/en-us/articles/47928855816595"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:574b6505b7dd6d119064698d9b5d2776bc58acbd18ec46c691d1929c00754ade · sha256:172fe2d4e99bff07… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer