CVE-2026-7494 is a Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 affecting versions from 3.0.0 up to but not including 3.94.0. The flaw exists in the SSL Certificate Retrieval endpoint, allowing an authenticated user with the nexus:ssl-truststore:read permission to induce the server to initiate outbound network connections to internal or otherwise restricted hosts. This could potentially be used to access internal resources not normally reachable by the user. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. As of the published date, no official fix or patch has been documented by Sonatype.

An attacker with the nexus:ssl-truststore:read permission can exploit this SSRF vulnerability to make the Nexus Repository server connect to internal or restricted network hosts. This could lead to unauthorized internal network scanning or access to services not directly accessible to the attacker. The impact is limited by the requirement of specific read permissions and does not include privilege escalation or remote code execution based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the nexus:ssl-truststore:read permission to trusted users only to minimize the risk of exploitation.