CVE-2026-17595: Nexus Repository 3 Information Disclosure

CVE-2026-17595 Overview

CVE-2026-17595 is an information disclosure vulnerability in Sonatype Nexus Repository 3. The flaw exists in the Java Expression Language (JEXL) sandbox used to evaluate Content Selectors. An authenticated account holding the nexus:selectors:create permission can craft JEXL expressions that read Java object properties never intended for exposure. Successful exploitation reveals internal Java Virtual Machine (JVM) class metadata, including class and classloader names. The issue is classified under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere. The vulnerability does not enable method invocation, object construction, or arbitrary code execution.

Critical Impact
Authenticated users with selector creation privileges can enumerate internal JVM metadata, aiding reconnaissance for follow-on attacks against the repository server.

Affected Products

Sonatype Nexus Repository 3 (versions prior to 3.95.0)
Deployments where users are granted the nexus:selectors:create permission
Content Selector configurations that rely on JEXL expressions

Discovery Timeline

2026-08-07 - CVE-2026-17595 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-17595

Vulnerability Analysis

Nexus Repository 3 uses Apache Commons JEXL to evaluate Content Selector expressions. Content Selectors decide which repository components a user can access based on attributes such as path or format. The JEXL engine runs inside a sandbox that is expected to constrain expressions to safe repository data types. The sandbox in affected versions does not fully restrict property access on evaluated objects. An attacker with rights to create selectors can traverse Java object graphs and read reflective metadata from JVM-managed objects. Retrieved values include class names, classloader identifiers, and other structural information about the running application.

Root Cause

The root cause is an incomplete allowlist in the JEXL sandbox governing which properties are readable during expression evaluation. Java objects passed into the expression context exposed inherited getters such as getClass() and downstream classloader accessors. Because the sandbox did not narrow property access to the intended data types, expression authors could pivot from repository objects to arbitrary JVM introspection surfaces.

Attack Vector

Exploitation requires an authenticated Nexus account holding the nexus:selectors:create permission over the network. The attacker submits a crafted JEXL expression through the Content Selector API or user interface. When Nexus evaluates the selector, the expression walks object properties and returns class and classloader metadata to the caller. No user interaction is required, and the attack does not depend on additional privileges beyond selector creation.

See the Sonatype Support Article for vendor technical detail on the sandbox restriction.

Detection Methods for CVE-2026-17595

Indicators of Compromise

Creation or modification of Content Selectors containing JEXL expressions that reference class, classLoader, or other reflective properties
Audit log entries showing selector API calls (/service/rest/v1/security/content-selectors) from unexpected accounts
Repeated selector preview or evaluation requests correlating with reconnaissance activity

Detection Strategies

Review audit logs for accounts newly granted the nexus:selectors:create privilege and validate business justification
Inspect stored Content Selector expressions for tokens such as .class, .classLoader, or getClass()
Alert on Nexus API traffic that repeatedly evaluates selectors against varied inputs within a short time window

Monitoring Recommendations

Forward Nexus Repository audit and request logs to a centralized logging platform for retention and correlation
Baseline normal selector creation frequency per user and flag deviations
Track privilege assignment events on the nexus-selector-admin role or equivalent custom roles

How to Mitigate CVE-2026-17595

Immediate Actions Required

Upgrade Nexus Repository 3 to version 3.95.0 or later, which restricts JEXL property access to intended data types
Audit all accounts currently granted the nexus:selectors:create permission and revoke access that is not required
Review existing Content Selectors for suspicious JEXL expressions and remove any that reference reflective properties

Patch Information

Sonatype addressed the flaw in Nexus Repository 3.95.0 by tightening the JEXL sandbox so that only properties on approved repository data types are accessible during expression evaluation. Release details are documented in the Sonatype Nexus Release Notes.

Workarounds

Restrict the nexus:selectors:create permission to a minimal set of trusted administrators until the patch is applied
Use CSEL (Content Selector Expression Language) rather than JEXL for new selectors, since CSEL exposes a narrower attribute surface
Place the Nexus administrative interface behind network access controls that limit exposure to trusted management networks

bash

# Configuration example: identify users with the vulnerable permission via the REST API
curl -u admin:${NEXUS_ADMIN_TOKEN} \
  -H 'Accept: application/json' \
  https://nexus.example.com/service/rest/v1/security/privileges | \
  jq '.[] | select(.actions[]? == "create" and (.name | test("selector"; "i")))'