CVE-2026-17600: Nexus Repository 3 Auth Bypass Flaw

CVE-2026-17600 Overview

CVE-2026-17600 affects Sonatype Nexus Repository 3 and stems from insufficient session lifecycle management [CWE-613]. The application does not immediately terminate active user sessions or revoke cached permissions when an administrator deletes an account, deactivates it, or changes its password. An authenticated user retains their existing session and effective privileges until that session independently expires. Depending on the permissions the account held before the change, an attacker or former user can continue to read, modify, or delete repository content after access was intended to be revoked. Sonatype addressed the issue in Nexus Repository 3.95.0.

Critical Impact
Deleted, deactivated, or password-reset accounts retain full repository access through their existing sessions, defeating account revocation as a security control.

Affected Products

Sonatype Nexus Repository 3 (versions prior to 3.95.0)
Self-hosted Nexus Repository deployments relying on session-based authentication
Environments using local, LDAP, or SAML-linked accounts managed through Nexus

Discovery Timeline

2026-08-07 - CVE-2026-17600 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-17600

Vulnerability Analysis

The flaw is an insufficient session expiration issue mapped to [CWE-613]. Nexus Repository 3 authenticates users and then caches their permissions server-side for the lifetime of the session. Administrative actions that change account state — deletion, deactivation, or password rotation — update the account record but do not propagate to active sessions. The runtime continues to authorize requests using the cached permissions attached to the session token.

This breaks a core assumption administrators make when revoking access. Password rotation after a suspected compromise, offboarding a departing employee, or disabling a service account all rely on immediate session termination. Because sessions remain valid, the security control fails silently until the session times out on its own.

Root Cause

The root cause is missing coupling between the account management subsystem and the session store. Account state transitions do not trigger invalidation of active sessions bound to that principal, and cached authorization decisions are not re-evaluated against the current account state on each request.

Attack Vector

Exploitation requires an existing authenticated session. A malicious insider warned of pending termination can maintain their session and continue to push, pull, or delete artifacts. An external attacker who obtained credentials and established a session retains access even after the victim rotates the password. The attack is network-reachable and requires no user interaction from the victim, but does require prior authentication (low privileges suffice).

No exploit code is required. The attacker simply continues issuing authenticated HTTP or API requests using the existing session cookie or token. See the Sonatype Support Article for vendor technical details.

Detection Methods for CVE-2026-17600

Indicators of Compromise

Successful API or UI requests authenticated as an account that has been deleted or deactivated in Nexus administration logs.
Repository write, delete, or configuration actions performed by a user account within the window after a password reset but before session expiration.
Session tokens active on Nexus after administrative account changes recorded in the audit log.

Detection Strategies

Correlate Nexus audit events for account deletion, deactivation, and password change against subsequent authenticated activity from the same principal.
Alert when a repository operation is attributed to a user whose account state is disabled or deleted in the identity source.
Baseline session durations and flag unusually long-lived sessions that persist across account lifecycle events.

Monitoring Recommendations

Forward Nexus Repository access and audit logs to a centralized analytics platform for cross-referencing with identity provider events.
Monitor artifact download, upload, and delete operations tied to accounts recently modified in Active Directory, LDAP, or the Nexus internal realm.
Track administrative changes to user accounts and generate follow-up checks confirming session termination.

How to Mitigate CVE-2026-17600

Immediate Actions Required

Upgrade Sonatype Nexus Repository 3 to version 3.95.0 or later, which addresses the session invalidation defect.
After upgrading, force logout of all active sessions to clear any pre-existing cached permissions.
Re-run account revocations performed before the upgrade — deleted, deactivated, or password-changed users may still hold valid sessions.

Patch Information

Sonatype released the fix in Nexus Repository 3.95.0. Review the Sonatype Nexus Release Notes for upgrade steps and version compatibility. The vendor advisory is available in the Sonatype Support Article.

Workarounds

Manually terminate active sessions from the Nexus administration interface immediately after any account deletion, deactivation, or password change.
Reduce the configured session timeout to shrink the exposure window between account state change and automatic session expiration.
Restart the Nexus Repository service during offboarding windows to flush all active sessions when patching cannot be scheduled immediately.

bash

# Example: reduce Nexus session timeout via the admin API
# Adjust the timeout (minutes) to shorten the exposure window
curl -u admin:$ADMIN_PWD -X PUT \
  -H "Content-Type: application/json" \
  -d '{"sessionTimeout": 15}' \
  https://nexus.example.com/service/rest/v1/security/user-session