CVE-2026-17594: Nexus Repository Auth Bypass Vulnerability

CVE-2026-17594 Overview

CVE-2026-17594 is an incorrect authorization vulnerability [CWE-863] in Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x. The flaw resides in the repository-creation user interface. Authorization checks validate one request field while a separate, attacker-controlled field determines the repository format actually created. An authenticated user with a delegated repository-admin privilege scoped to one repository format can create a repository of a different, unauthorized format. The anonymous user cannot hold this privilege by default and is not affected. Sonatype fixed the issue in version 3.95.0.

Critical Impact
A low-trust delegated admin can bypass format-scoped authorization to create repositories in formats they were never granted, undermining tenant isolation and repository governance.

Affected Products

Sonatype Nexus Repository 3 Community Edition, versions 3.0.0 through 3.94.x
Sonatype Nexus Repository 3 Professional, versions 3.0.0 through 3.94.x
Fixed release: Nexus Repository 3.95.0

Discovery Timeline

2026-08-07 - CVE-2026-17594 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-17594

Vulnerability Analysis

The vulnerability originates in the repository-creation workflow of the Nexus Repository administrative UI. The server enforces role-based access control on repository format when delegated administrators submit creation requests. However, the authorization decision consults a different field in the request than the field consumed by the repository provisioning logic. This decoupling produces a classic time-of-check versus time-of-use style authorization mismatch, categorized under [CWE-863: Incorrect Authorization]. An account holding nx-repository-admin-<format>-*-* privileges for one format can submit a request that passes the format-scoped authorization check while the backend creates a repository in a completely different format. The impact is a horizontal-to-vertical privilege escalation within the repository management surface, exposing integrity of build artifacts and downstream software supply chains.

Root Cause

The root cause is inconsistent parameter binding. The authorization filter reads the repository format from one request field, while the repository factory instantiates the store based on a separate, attacker-controlled field. The two fields are never reconciled before the privileged action executes.

Attack Vector

Exploitation requires an authenticated account with a delegated repository-admin privilege scoped to at least one format. The attacker crafts an HTTP request to the repository-creation endpoint, sets the authorization-facing field to a permitted format, and sets the provisioning field to a different, unauthorized format. No user interaction is required. The attack is delivered over the network to the Nexus web interface or REST API.

See the Sonatype Support Article for vendor technical details.

Detection Methods for CVE-2026-17594

Indicators of Compromise

Repository creation audit events where the acting user's granted nx-repository-admin-<format> privileges do not match the format of the newly created repository.
Unexpected repositories appearing in formats such as docker, maven2, npm, pypi, or raw that do not align with an organization's delegated administration model.
HTTP POST requests to /service/rest/v1/repositories/* from non-superuser accounts creating repositories in previously unused formats.

Detection Strategies

Baseline all existing repositories and their formats, then alert on any new repository whose format falls outside the creator's delegated scope.
Correlate Nexus audit logs with role and privilege assignments to flag format mismatches at creation time.
Monitor for use of the repository-creation REST API by accounts that historically only used the UI, or by accounts scoped to a single format.

Monitoring Recommendations

Enable and forward Nexus Repository audit logs to a centralized SIEM and retain repository-creation events with the full request payload.
Alert on repository-creation actions performed by any account other than a global administrator until upgrade to 3.95.0 is complete.
Review scheduled tasks, cleanup policies, and content selectors bound to newly created repositories, as unauthorized repositories may inherit permissive defaults.

How to Mitigate CVE-2026-17594

Immediate Actions Required

Upgrade Nexus Repository 3 CE/Pro to version 3.95.0 or later, following the Sonatype Nexus Release Notes.
Inventory all accounts holding nx-repository-admin-* privileges and confirm that only trusted operators retain delegated repository administration.
Audit repositories created since delegated admin accounts were provisioned and remove any created outside the account's authorized format.

Patch Information

Sonatype resolved CVE-2026-17594 in Nexus Repository 3.95.0. The fix reconciles the authorization check with the field used to provision the repository so that both operate on the same format value. Refer to the Sonatype Nexus Release Notes for upgrade procedures and validation steps.

Workarounds

Revoke delegated nx-repository-admin-<format> privileges until the upgrade is applied; restrict repository creation to full administrators.
Place the Nexus administrative UI and REST API behind network controls that limit access to trusted operators and jump hosts.
Enable strict audit logging and require change-management approval before any repository creation is executed.

bash

# Configuration example: restrict repository creation to admin role only
# Remove delegated repository-admin privileges from non-admin roles until 3.95.0 is deployed
curl -u admin:$ADMIN_PW -X GET \
  "https://nexus.example.com/service/rest/v1/security/roles" | \
  jq '.[] | select(.privileges[] | test("nx-repository-admin-"))'

# Then update affected roles via the UI or API to remove the privilege
# See: https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html