CVE-2026-17599 Overview
CVE-2026-17599 affects Sonatype Nexus Repository 3. The product exposes an onboarding endpoint that changes the administrator account password during initial setup. The endpoint fails to verify that onboarding is still active, checking only for the presence of a local onboarding artifact. Any authenticated user holding the nexus:* permission can call the endpoint after onboarding completes to overwrite the administrator password. Existing sessions are not invalidated after the password change, allowing continued access under the prior credentials. The weakness is classified as [CWE-620] Unverified Password Change.
Critical Impact
Authenticated users with broad nexus:* permissions can replace the administrator password and take over the primary administrative account of the repository.
Affected Products
- Sonatype Nexus Repository 3 (versions prior to 3.95.0)
- Deployments where non-administrative principals hold the nexus:* permission
- Instances retaining the local onboarding artifact after initial setup
Discovery Timeline
- 2026-08-07 - CVE-2026-17599 published to the National Vulnerability Database (NVD)
- 2026-08-07 - Last updated in NVD database
Technical Details for CVE-2026-17599
Vulnerability Analysis
The flaw resides in the onboarding password-change endpoint of Nexus Repository 3. During initial installation, an administrator must set a new password to replace the temporary one. The endpoint that performs this operation is intended to be reachable only while onboarding is in progress. Instead, the server determines onboarding status by checking for a local file artifact rather than validating live onboarding state. If that artifact persists, the endpoint remains callable indefinitely.
An attacker abusing this issue must already be authenticated and hold the nexus:* permission. That permission set is typically reserved for administrators, but is sometimes granted to automation accounts or elevated service roles. Once invoked, the endpoint rewrites the administrator password without prompting for the current credential. The server also fails to invalidate active administrator sessions, so any pre-existing session tokens continue functioning after the takeover.
Root Cause
The root cause is an incorrect authorization state check. The application trusts a filesystem artifact as a proxy for onboarding status. This condition can outlive the onboarding phase, leaving a privileged password-reset path exposed. The endpoint additionally omits both prior-password verification and session invalidation after a successful change.
Attack Vector
Exploitation occurs over the network against an authenticated principal that holds nexus:*. The attacker issues a request to the onboarding password-change endpoint and supplies a new administrator password. The server accepts the change, and the attacker authenticates as admin. Concurrent sessions established before the change remain valid. Refer to the Sonatype Support Article for advisory details.
Detection Methods for CVE-2026-17599
Indicators of Compromise
- Unexpected administrator password reset events in Nexus Repository audit logs outside a documented onboarding window.
- Successful requests to the onboarding password-change endpoint from non-installer accounts.
- Presence of the local onboarding artifact on production Nexus Repository hosts long after initial deployment.
Detection Strategies
- Alert on any administrator password-change event where the actor is not the installing user or an approved administrator.
- Correlate password-change events with subsequent administrator authentications from new source IP addresses or user agents.
- Review role and permission assignments for accounts holding the nexus:* permission and flag non-human accounts.
Monitoring Recommendations
- Ingest Nexus Repository audit logs into a centralized log platform and retain them for role and permission-change forensics.
- Monitor for continued availability of onboarding endpoints on production instances after deployment.
- Track administrator session activity for anomalous access following any password modification.
How to Mitigate CVE-2026-17599
Immediate Actions Required
- Upgrade Nexus Repository 3 to version 3.95.0 or later per the Sonatype Nexus Release Notes.
- Audit all accounts and roles that carry the nexus:* permission and revoke it where not strictly required.
- Force administrator password rotation and terminate all active administrator sessions after upgrading.
Patch Information
Sonatype addressed the issue in Nexus Repository 3.95.0. The fix enforces that the onboarding password-change endpoint operates only during active onboarding and invalidates existing sessions after a password change. Full release details are available in the Sonatype Nexus Release Notes.
Workarounds
- Restrict the nexus:* permission to a minimal set of trusted administrator accounts until the upgrade is applied.
- Block network access to onboarding endpoints from untrusted networks using a reverse proxy or firewall rule.
- Manually remove or protect the onboarding artifact on hosts where initial setup has completed, following Sonatype guidance.
# Configuration example
# Review accounts holding the nexus:* privilege via the Nexus REST API
curl -u admin:'<password>' \
-H 'Accept: application/json' \
https://<nexus-host>/service/rest/v1/security/privileges
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
