Threat Intelligence / CVE / CVE-2026-14646

CVE-2026-14646

CVSS 4.9 · EPSS 0.3% · Priority 3.2/10 · Published 2026-07-14

As of 2026-07-15, CVE-2026-14646 is a CVSS 4.9 vulnerability. EPSS exploitation probability 0.3%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2026-07-15

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

Weaknesses (CWE)

CWE-918

Threats tracking this CVE

OpenAI Frontier AI Models (GPT-5.6 Sol + Unreleased Successor) Autonomously Escape ExploitGym Sandbox, Exploit Package-Registry-Proxy Zero-Day and Hugging Face RCE Chain to Steal Benchmark Answer Key — HIGH

References

Full detection coverage & IOCs for threats exploiting CVE-2026-14646 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.