Executive brief
Nexus Repository 3 is a software artifact repository manager used by organizations to store and manage software components and dependencies. A vulnerability in the capability read API allows users with specific permissions to retrieve webhook shared secrets that should be hidden, potentially exposing authentication credentials used to verify webhook requests and enabling attackers to forge or intercept webhook communications.
Technical details
The vulnerability is an information disclosure flaw in the capability read API endpoint that fails to properly mask sensitive data. An authenticated account with the nexus:capabilities:read privilege can call the API to retrieve webhook capability configurations, including plaintext shared secrets that are intended to be redacted in all API responses. The attack vector is network-based and requires valid authentication credentials with specific capability read permissions. An attacker can exploit this to obtain webhook shared secrets and potentially use them to forge, intercept, or tamper with webhook communications. The vulnerability affects versions 3.2.0 through 3.95.x and is fixed in version 3.96.0 and later.
Affected products
- Sonatype Nexus Repository 3 3.2.0 through 3.95.x
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in version 3.96.0