CVE-2026-77124

CVE-2026-77124 is a security-bypass flaw in Sonatype Nexus Repository 3: the script execution REST endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. It is triggered when an administrator sets nexus.scripts.allowCreation=false expecting that to fully block script execution, yet any account that still holds script-execution permission can continue invoking previously created scripts via the API. An attacker or over-privileged account with valid credentials and script-execution rights gains continued ability to run stored scripts on the server, enabling data access, configuration changes, or other scripted actions despite the administrator's lockdown. Any organization running an affected Nexus Repository 3 version and relying on the allowCreation=false setting as a hard block, while accounts retain script-execution permissions, is affected. There is currently no public proof of concept, no CISA KEV listing, and a low EPSS score of 0.3%, indicating no known exploitation at this time.

What to do: Upgrade Nexus Repository 3 to the fixed release identified in the Sonatype advisory, where the script run endpoint correctly enforces the disabled state. As an interim mitigation, revoke script-execution permissions from accounts that do not need them, remove or review any stored scripts that could be abused, and restrict API access to /service/rest/v1/script/*. Do not rely on nexus.scripts.allowCreation=false alone as a complete block.