CVE-2026-17597— Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification
Quick assessment
Affected
Sonatype Nexus Repository 3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sonatype Nexus Repository是美国Sonatype公司的一个集中存储、管理和分发软件包、二进制文件、容器镜像、构建制品及AI模型的制品仓库管理平台。 Sonatype Nexus Repository CE/Pro 3.94.1及之前版本存在服务端请求伪造漏洞，该漏洞源于电子邮件配置验证功能存在服务端请求伪造漏洞，具有nexus:settings:update权限的用户可提交任意主机和端口值，导致服务器尝试对内部或受限网络地址发起出站连接，并可通过服务器响应差异推断内部主机和端口是否
Possible ATT&CK Techniques 2 AI
T1071 · Application Layer Protocol T1590 · Gather Victim Network InformationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.0.0< 3.95.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-17597
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification
Source: CVE Program / CVE List V5
Vulnerability Description
Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server's response could be used to infer whether internal hosts and ports are reachable. This issue affects Nexus Repository 3 CE/Pro versions up to and including 3.94.1, and is fixed in version 3.95.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Sonatype Nexus Repository 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Sonatype Nexus Repository是美国Sonatype公司的一个集中存储、管理和分发软件包、二进制文件、容器镜像、构建制品及AI模型的制品仓库管理平台。 Sonatype Nexus Repository CE/Pro 3.94.1及之前版本存在服务端请求伪造漏洞，该漏洞源于电子邮件配置验证功能存在服务端请求伪造漏洞，具有nexus:settings:update权限的用户可提交任意主机和端口值，导致服务器尝试对内部或受限网络地址发起出站连接，并可通过服务器响应差异推断内部主机和端口是否
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.0.0 ~ 3.95.0 |
cpe:2.3:a:sonatype:nexus_repository_manager:3.0.0:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-17597
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-17597
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-17597 (1)
Vendor Pages for CVE-2026-17597 (1)
Same Patch Batch · Sonatype · 2026-08-07 · 11 CVEs total
| CVE-2026-17601 | 8.9 HIGH | Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator |
| CVE-2026-17600 | 8.7 HIGH | Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation |
| CVE-2026-17603 | 8.7 HIGH | Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration |
| CVE-2026-14644 | 8.6 HIGH | Nexus Repository 3 - Privilege Escalation |
| CVE-2026-17594 | 8.2 HIGH | Nexus Repository 3 - Authorization Bypass in Repository Creation |
| CVE-2026-17593 | 7.2 HIGH | Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration |
| CVE-2026-17599 | 6.9 MEDIUM | Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint |
| CVE-2026-17596 | 6.3 MEDIUM | Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name |
| CVE-2026-17598 | 5.3 MEDIUM | Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration |
| CVE-2026-17595 | 5.3 MEDIUM | Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass |
IV. Related Vulnerabilities
Same product: Nexus Repository 3
-
CVE-2026-77121
Nexus Repository 3 - Denial of Service via Unbounded Maven P -
CVE-2026-77123
Nexus Repository 3 - Webhook Secret Disclosure via Capabilit -
CVE-2026-77124
Nexus Repository 3 - Script Execution Disable Setting Not En -
CVE-2026-77122
Nexus Repository 3 - Incorrect Authorization Allows Disclosu -
CVE-2026-77125
Nexus Repository 3 - Incorrect Authorization on Blobstore Gr
Same vendor: Sonatype
-
CVE-2026-77123
Nexus Repository 3 - Webhook Secret Disclosure via Capabilit -
CVE-2026-77121
Nexus Repository 3 - Denial of Service via Unbounded Maven P -
CVE-2026-77124
Nexus Repository 3 - Script Execution Disable Setting Not En -
CVE-2026-77122
Nexus Repository 3 - Incorrect Authorization Allows Disclosu -
CVE-2026-77125
Nexus Repository 3 - Incorrect Authorization on Blobstore Gr
Same weakness: CWE-918
-
CVE-2026-103530
decolua 9Router Search Endpoint ssrfGuard.js fetch server-si -
CVE-2026-102105
Kiteworks Email Protection Gateway server-side request forge -
CVE-2023-54402
iDocView SSRF via /doc/upload Endpoint Hardcoded Token -
CVE-2026-102104
Kiteworks Email Protection Gateway server-side request forge -
CVE-2026-102103
Kiteworks Email Protection Gateway server-side request forge
V. Comments for CVE-2026-17597
No comments yet