CVE-2026-17596: Nexus Repository 3 Stored XSS Vulnerability

CVE-2026-17596 Overview

CVE-2026-17596 is a stored cross-site scripting (XSS) vulnerability in Sonatype Nexus Repository 3. An authenticated user holding the nexus:blobstores:create or nexus:blobstores:update permission can inject malicious script content into a blob store name. The payload is stored server-side and executes in another user's browser when that user views the system health-check status page. Sonatype fixed the issue in Nexus Repository version 3.95.0. The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
A privileged Nexus Repository user can execute arbitrary JavaScript in the session context of any administrator viewing the health-check status, enabling session theft, forced actions, or repository tampering.

Affected Products

Sonatype Nexus Repository 3 versions prior to 3.95.0
Blob store administration component (create/update workflows)
System health-check status view

Discovery Timeline

2026-08-07 - CVE-2026-17596 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-17596

Vulnerability Analysis

The flaw stems from missing output encoding when Nexus Repository renders blob store names inside the system health-check status view. When a user with the nexus:blobstores:create or nexus:blobstores:update permission creates or renames a blob store, the supplied name is stored without sanitization of HTML or JavaScript characters. Any user who later opens the health-check page causes the browser to parse the injected content as active markup rather than text.

Because the payload persists in server-side configuration, the vulnerability is a stored XSS rather than a reflected one. Every subsequent visit to the affected view re-executes the payload until the offending blob store name is removed or renamed. The attack requires authenticated access with blob store management permissions and a victim who interacts with the health-check UI.

Root Cause

The blob store name field is trusted downstream. The rendering layer for the health-check status view treats stored names as safe HTML instead of applying context-appropriate encoding, allowing <script> tags and event-handler attributes to reach the DOM.

Attack Vector

An attacker first obtains an account with nexus:blobstores:create or nexus:blobstores:update privileges. They create or update a blob store, embedding JavaScript in the name field. When an administrator or other user with access to health-check status loads the page, the browser executes the payload under the Nexus origin. Full technical details are available in the Sonatype Support Article and the Sonatype Nexus Release Notes.

Detection Methods for CVE-2026-17596

Indicators of Compromise

Blob store names containing HTML tags, angle brackets, or javascript: URI fragments in Nexus configuration exports.
Audit log entries showing blobstore.create or blobstore.update actions with unusual name payloads.
Browser console errors or Content Security Policy (CSP) violations reported by users visiting the health-check page.

Detection Strategies

Query Nexus configuration for blob store names that fail a strict alphanumeric-plus-hyphen regex.
Review authentication logs for accounts granted blob store permissions that do not require them.
Correlate access to /service/rest/v1/blobstores endpoints with subsequent health-check page views by other users.

Monitoring Recommendations

Enable and centralize Nexus audit logging, then forward events to your SIEM for retention and search.
Alert on any modification to blob store definitions outside of approved change windows.
Monitor administrator browser sessions for anomalous outbound requests originating from the Nexus origin.

How to Mitigate CVE-2026-17596

Immediate Actions Required

Upgrade Nexus Repository 3 to version 3.95.0 or later without delay.
Audit existing blob store names and rename any that contain non-standard characters.
Review and reduce the set of users holding nexus:blobstores:create and nexus:blobstores:update permissions.

Patch Information

Sonatype resolved CVE-2026-17596 in Nexus Repository 3.95.0. Refer to the Sonatype Nexus Release Notes for upgrade instructions and the Sonatype Support Article for advisory details.

Workarounds

Restrict blob store management permissions to a minimal set of trusted operators until the upgrade is complete.
Enforce a naming policy for blob stores that rejects HTML control characters at the process level.
Deploy a Content Security Policy at the reverse proxy in front of Nexus to limit inline script execution.

bash

# Example: verify installed Nexus Repository version before and after upgrade
curl -s -u admin:$NEXUS_ADMIN_PASS \
  https://nexus.example.com/service/rest/v1/status \
  -H 'Accept: application/json'

# Example: list current blob stores and inspect names for suspicious content
curl -s -u admin:$NEXUS_ADMIN_PASS \
  https://nexus.example.com/service/rest/v1/blobstores \
  | jq '.[] | .name'