Skip to content
OpenAdvisories
High WID-SEC-2026-2713 11 CVEs

Sonatype Nexus Repository Manager: Mehrere Schwachstellen

Published Aug 9, 2026 · Updated Aug 9, 2026 · de-DE

Vendor: Sonatype Product: Nexus Repository Manager Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Sonatype Nexus Repository Manager ausnutzen, um Daten offenzulegen oder zu Manipulieren, Code auszuführen oder Rechte zu erweitern.

Product

Sonatype Nexus Repository Manager ist ein Verwaltungstool für Software-Bestandteile.

Vulnerabilities 11

  • High 8.9
    CVE-2026-17601

    Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator

    A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional autho…

    Sonatype Nexus Repository 3
  • High 8.7
    CVE-2026-17600

    Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation

    Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time o…

    Sonatype Nexus Repository 3 org.sonatype.security:security-system org.sonatype.nexus.common.components:nexus-security
  • High 8.7
    CVE-2026-17603

    Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API

    Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary S…

    Sonatype Nexus Repository 3
  • High 8.6
    CVE-2026-14644

    Nexus Repository 3 - Privilege Escalation

    Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a …

    Sonatype Nexus Repository 3
  • High 8.2
    CVE-2026-17594 Scanner template

    Nexus Repository 3 - Authorization Bypass in Repository Creation

    Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific reposi…

    Sonatype Nexus Repository 3
  • High 7.2
    CVE-2026-17593

    Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration

    An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not …

    Sonatype Nexus Repository
  • Medium 6.9
    CVE-2026-17599

    Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint

    Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a …

    Sonatype Nexus Repository 3
  • Medium 6.3
    CVE-2026-17596

    Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name

    Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the…

    Sonatype Nexus Repository 3
  • Medium 5.3
    CVE-2026-17595

    Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

    Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, d…

    Sonatype Nexus Repository 3
  • Medium 5.3
    CVE-2026-17598

    Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration

    Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task ty…

    Sonatype Nexus Repository 3
  • Medium 5.1
    CVE-2026-17597

    Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification

    Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endp…

    Sonatype Nexus Repository 3

Revision history

  1. #1

    Initiale Fassung

References