CVE-2026-17601: Privilege Escalation Vulnerability

CVE-2026-17601 Overview

CVE-2026-17601 is a broken access control vulnerability affecting Sonatype Nexus Repository. A user granted permission to update privilege definitions can modify a wildcard privilege already bound to their own role. This modification expands the privilege's scope without triggering any additional authorization check or requiring role reassignment. The result is vertical privilege escalation to full administrative access from a limited management permission. The weakness maps to [CWE-862: Missing Authorization]. Sonatype addressed the issue in Nexus Repository 3.95.0. See the Sonatype Nexus Release Notes and the Sonatype Support Article for vendor guidance.

Critical Impact
An authenticated user with privilege-update rights can grant themselves administrative control over the repository, exposing all hosted artifacts, credentials, and CI/CD build pipelines.

Affected Products

Sonatype Nexus Repository versions prior to 3.95.0
Deployments where non-administrative roles are granted privilege-management permissions
Environments assigning wildcard privileges to user-facing roles

Discovery Timeline

2026-08-07 - CVE-2026-17601 published to the National Vulnerability Database (NVD)
2026-08-07 - Sonatype publishes advisory and release notes referencing the fix in Nexus Repository 3.95.0
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-17601

Vulnerability Analysis

Sonatype Nexus Repository uses a role-based access control (RBAC) model built on privileges, roles, and users. Privileges can be scoped narrowly to specific repositories or resources, or defined as wildcard privileges (nexus:* style patterns) that match multiple resources. Administrators assign privileges to roles, and roles to users.

The vulnerability arises because the authorization check that gates privilege modification only verifies that the caller holds the update-privilege permission. It does not verify that the caller is authorized to expand the effective scope of a privilege they already possess through their role. An attacker can therefore edit the pattern of a wildcard privilege attached to their own role and gain broader access without any reassignment event.

Root Cause

The root cause is missing authorization on the write path for privilege definitions. The API enforces "can the caller update privileges" but omits a secondary check comparing the new privilege scope to the caller's existing effective permissions. This allows a caller to elevate the scope of a privilege they already inherit through their role.

Attack Vector

The attack requires authenticated network access and low privileges — specifically, any account that holds the permission to update privilege definitions. The attacker identifies a wildcard privilege already assigned to their own role, invokes the privilege update API, and rewrites the pattern to match administrative resources such as nexus:*. On the next authorization evaluation, the attacker inherits administrative access. No user interaction, secondary approval, or role reassignment is needed. Verified proof-of-concept code is not publicly available at time of writing; refer to the Sonatype advisory for reproduction context.

Detection Methods for CVE-2026-17601

Indicators of Compromise

Audit log entries showing PUT or POST calls to Nexus privilege management endpoints (for example /service/rest/v1/security/privileges/*) originating from non-administrative accounts.
Privilege definitions whose pattern was widened to include wildcards such as * or administrative resource names.
New administrative actions (user creation, repository deletion, script execution) performed by accounts that previously lacked those rights.

Detection Strategies

Baseline the set of wildcard privileges and alert on any change to their pattern, actions, or type fields.
Correlate privilege-update events with the acting user's assigned role and flag cases where the update grants access beyond that role's prior scope.
Monitor for privilege modifications performed outside of change-management windows or by service accounts not designated for RBAC administration.

Monitoring Recommendations

Forward Nexus Repository audit logs and access logs to a centralized SIEM or data lake for retention and analytics.
Alert on sequences where a privilege update is quickly followed by administrative operations from the same session or IP.
Review role membership monthly and reconcile with the current list of privileges that grant update rights on the RBAC subsystem.

How to Mitigate CVE-2026-17601

Immediate Actions Required

Upgrade Sonatype Nexus Repository to version 3.95.0 or later as documented in the release notes.
Audit all accounts that hold the nexus:privileges:update permission and revoke it from any role that does not strictly require it.
Review existing wildcard privileges and replace them with narrowly scoped equivalents where possible.
Rotate credentials, tokens, and deployment keys stored in Nexus if unauthorized privilege changes are found in audit logs.

Patch Information

Sonatype released the fix in Nexus Repository 3.95.0. The patched build enforces an additional authorization check on privilege updates so that a caller cannot expand the scope of a privilege beyond what their own effective permissions authorize. Details are published in the Sonatype Nexus Release Notes and the Sonatype Support Article.

Workarounds

Restrict the privilege-update permission to a small, dedicated administrator role until the upgrade is applied.
Remove wildcard privileges from any role assigned to non-administrative users.
Place the Nexus Repository administrative API behind network controls that limit access to trusted management hosts.
Enable full audit logging and review privilege changes daily until the environment is patched.

bash

# Example: list privileges via the Nexus REST API to identify wildcard patterns for review
curl -u admin:PASSWORD \
  -H 'Accept: application/json' \
  https://nexus.example.com/service/rest/v1/security/privileges \
  | jq '.[] | select(.pattern? | test("\\*"))'