THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-14646 (HIGH 7.7) — Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — i

[NVD] CVE-2026-14646 (HIGH 7.7) — Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — i

lownvdPublished 2026-07-14

CVE-2026-14646 CVSS: 7.7 HIGH Published: 2026-07-14T17:16:44.410

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is ena

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-14646cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-14646