CVE-2026-17598: Nexus Repository Privilege Escalation Flaw

CVE-2026-17598 Overview

CVE-2026-17598 affects Sonatype Nexus Repository 3. The application does not properly filter internal configuration keys from user-supplied task properties when an administrator creates or updates a scheduled task through the administrative UI. An authenticated account with permission to create at least one scheduled task type can supply a crafted property value. The crafted value causes the system to overwrite the configuration of an unrelated, existing scheduled task instead of creating a new one. The issue is classified as improperly controlled modification of dynamically-determined object attributes [CWE-915].

Critical Impact
An authenticated low-privileged user can silently modify unrelated scheduled task configurations, undermining the integrity of repository automation and maintenance jobs.

Affected Products

Sonatype Nexus Repository 3 versions prior to 3.95.0
Sonatype Nexus Repository 3 administrative UI scheduled task subsystem
Deployments exposing task-creation permissions to non-administrator roles

Discovery Timeline

2026-08-07 - CVE-2026-17598 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-17598

Vulnerability Analysis

Sonatype Nexus Repository 3 allows administrators and permitted users to schedule background tasks such as blob store compaction, index rebuilding, and cleanup jobs. Each task is stored as a configuration object keyed by an internal identifier. The vulnerability stems from the task creation and update handlers accepting a properties map from the client without stripping reserved internal keys. An attacker who can create any single scheduled task type can inject one of these reserved keys into the properties map. The server then treats the crafted value as a reference to an existing task identifier and applies the submitted configuration to that unrelated task record. The result is a targeted overwrite of another task's configuration under the guise of a normal create-or-update operation.

Root Cause

The root cause is missing input filtering on the task properties collection. The controller does not enforce an allowlist of client-writable keys before persisting the object. Because internal keys are permitted to flow from user input into object-attribute assignment, the flaw maps to [CWE-915]: improperly controlled modification of dynamically-determined object attributes.

Attack Vector

The attack is network-based and requires an authenticated session with at least one scheduled task creation permission. No user interaction on the victim side is required. The attacker submits a task create or update request through the administrative UI or its backing REST endpoint, embedding a reserved configuration key in the properties. The server writes the attacker-controlled values onto an existing task instead of creating a new record.

No verified public proof-of-concept code is available. See the Sonatype Support Article for vendor technical details.

Detection Methods for CVE-2026-17598

Indicators of Compromise

Unexpected configuration changes on scheduled tasks that were not modified by an administrator through normal change control.
Scheduled task audit entries showing create or update actions from accounts that do not typically manage the affected task.
Task property payloads in request logs that include internal or reserved configuration key names.
Newly scheduled or altered task execution times, cron expressions, or target repositories that do not match documented operational baselines.

Detection Strategies

Enable and centralize Nexus Repository audit logs, then alert on any TASK_UPDATE or TASK_CREATE event initiated by non-administrator accounts.
Inspect HTTP request bodies to the scheduled task API for unexpected keys beyond the documented task type schema.
Baseline scheduled task definitions in a version-controlled export and diff periodically to identify unauthorized configuration drift.

Monitoring Recommendations

Forward Nexus application and audit logs to a centralized log platform with retention sufficient for incident review.
Monitor authentication events for accounts holding task creation permissions and correlate with subsequent task modifications.
Alert on any change to high-impact tasks such as blob store compaction, cleanup, and backup jobs.

How to Mitigate CVE-2026-17598

Immediate Actions Required

Upgrade Sonatype Nexus Repository 3 to version 3.95.0 or later as documented in the Sonatype Nexus Release Notes.
Review current role assignments and remove scheduled task creation permissions from accounts that do not require them.
Export and archive the current scheduled task configuration before patching so post-upgrade state can be validated.

Patch Information

Sonatype addressed the issue in Nexus Repository 3.95.0. The fix filters internal configuration keys out of user-supplied task properties before persistence. Refer to the Sonatype Nexus Release Notes for upgrade procedures and the Sonatype Support Article for advisory details.

Workarounds

Restrict the nx-tasks-create and equivalent task management privileges to a small set of trusted administrators until the upgrade is applied.
Place the Nexus administrative UI behind network controls that limit access to trusted management networks.
Increase audit-log review frequency for scheduled task changes during the pre-patch window.

bash

# Example: verify running Nexus Repository version before and after upgrade
curl -u admin:REDACTED \
  -H "Accept: application/json" \
  https://nexus.example.com/service/rest/v1/status

# List scheduled tasks to baseline configuration
curl -u admin:REDACTED \
  -H "Accept: application/json" \
  https://nexus.example.com/service/rest/v1/tasks