Executive brief
Sonatype Nexus Repository Manager, a platform used by organizations to manage and distribute software components, contains a security vulnerability in its LDAP configuration module. An administrator attempting to connect the system to an external directory service could be tricked into connecting to a malicious server, potentially leading to unauthorized internal network connections or data exposure. This could allow an attacker to probe internal systems or execute unauthorized actions within the repository manager's environment.
Technical details
Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 are vulnerable to Server-Side Request Forgery (SSRF) and Deserialization of Untrusted Data (CWE-502, CWE-918). The vulnerability exists within the LDAP connectivity testing and configuration component. An authenticated administrator (high privileges required) interacting with a malicious LDAP server can trigger the application to initiate unintended outbound connections or process malicious serialized data. This could lead to internal port scanning, interaction with internal services, or potential remote code execution depending on the environment's deserialization gadgets. The issue is resolved in version 3.92.0.
Affected products
- Sonatype Nexus Repository Manager 3.0.0 through 3.91.1
Timeline
- 2026-05-11: advisory: NVD publication date
- 2026-05-11: disclosed: CVE-2026-3048 published by Sonatype