Quick answers
- Is CVE-2026-77123 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77123 being exploited in the wild.
- How severe is CVE-2026-77123?
- Medium severity, with a CVSS score of 6.5, published 2 September 2026.
- Which products and versions are affected?
- Sonatype Nexus Repository 3 3.2.0 through 3.95.x.
- Is there a fix for CVE-2026-77123?
- A patch was published on 2026-09-02: Fixed in version 3.96.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77123 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-77123?
- Check whether you run Sonatype Nexus Repository 3 or Sonatype Nexus Repository Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an information disclosure flaw in the capability read API endpoint that fails to properly mask sensitive data. An authenticated account with the nexus:capabilities:read privilege can call the API to retrieve webhook capability configurations, including plaintext shared secrets that are intended to be redacted in all API responses. The attack vector is network-based and requires valid authentication credentials with specific capability read permissions. An attacker can exploit this to obtain webhook shared secrets and potentially use them to forge, intercept, or tamper with webhook communications. The vulnerability affects versions 3.2.0 through 3.95.x and is fixed in version 3.96.0 and later.
Affected products
- Sonatype Nexus Repository 3 3.2.0 through 3.95.x
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in version 3.96.0