CVE-2026-17603: Nexus Repository 3 RCE Vulnerability

CVE-2026-17603 Overview

Sonatype Nexus Repository 3 fails to sufficiently restrict which HikariCP connection-pool properties can be set through the DataStore configuration API. An authenticated user holding the nx-datastores-update permission can set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this behavior can be leveraged to achieve remote code execution as the Nexus process user. The vulnerability is tracked under [CWE-94] Improper Control of Generation of Code.

Critical Impact
An authenticated attacker with datastore update rights can achieve remote code execution on the Nexus Repository host through malicious SQL injected into the H2 database connection initialization sequence.

Affected Products

Sonatype Nexus Repository 3 (prior to 3.95.0)
Deployments using the default H2 database backend
Nexus Repository instances exposing the DataStore configuration API to non-administrative operators

Discovery Timeline

2026-08-07 - CVE-2026-17603 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-17603

Vulnerability Analysis

Nexus Repository 3 exposes a DataStore configuration API that accepts HikariCP connection-pool property key-value pairs. The application does not enforce an allow-list of safe HikariCP properties before applying them to the underlying pool configuration. This permits a caller with the nx-datastores-update permission to set sensitive properties such as connectionInitSql, which HikariCP executes against the database each time a new connection is opened.

When Nexus runs against its default H2 database, the SQL execution surface includes H2 features that can invoke Java code. An attacker can craft an initialization statement that triggers Java routine execution within the H2 engine, resulting in code execution in the context of the Nexus process user. The permission requirement limits the attack to authenticated principals, but it does not restrict the attack to administrators only.

Root Cause

The root cause is missing input validation on the set of HikariCP properties accepted by the DataStore configuration API. HikariCP treats connectionInitSql as a legitimate configuration knob, so the pool layer executes whatever SQL is supplied. Nexus should have restricted configurable properties to a curated list that excludes any option capable of executing arbitrary SQL, files, or scripts.

Attack Vector

Exploitation requires network access to the Nexus Repository management interface and an account with the nx-datastores-update permission. The attacker submits a DataStore configuration update that includes connectionInitSql set to attacker-controlled SQL. The next connection created by the HikariCP pool triggers execution of that SQL. On H2 backends, the SQL payload can invoke Java functionality that yields command execution on the host. Refer to the Sonatype Support Article and the Sonatype Nexus 3.95 Release Notes for vendor-published technical detail.

// No verified proof-of-concept code is published for this CVE.
// The vulnerability is described in prose above; see vendor references for details.

Detection Methods for CVE-2026-17603

Indicators of Compromise

DataStore configuration changes that include a connectionInitSql property or other non-standard HikariCP keys.
Unexpected child processes spawned by the Nexus Repository JVM, particularly shells, scripting interpreters, or download utilities.
New or modified H2 aliases, CREATE ALIAS statements, or references to javax.script or java.lang.Runtime within database logs.
Outbound network connections from the Nexus host to unfamiliar destinations shortly after a DataStore update.

Detection Strategies

Audit Nexus Repository administrative logs for use of the DataStore configuration API and correlate with the acting user account.
Alert on any HTTP request to DataStore management endpoints containing the string connectionInitSql.
Monitor JVM process telemetry for anomalous execve activity descending from the Nexus process on Linux hosts or from java.exe on Windows hosts.

Monitoring Recommendations

Forward Nexus Repository application and audit logs to a centralized analytics platform for retention and search.
Track the assignment and use of the nx-datastores-update permission and treat unexpected grants as high-priority events.
Baseline outbound network activity from the Nexus host so that post-exploitation callbacks stand out against normal repository traffic.

How to Mitigate CVE-2026-17603

Immediate Actions Required

Upgrade Nexus Repository 3 to version 3.95.0 or later, as documented in the Sonatype Nexus 3.95 Release Notes.
Review all accounts and roles that hold the nx-datastores-update permission and revoke it from users who do not require it.
Inspect recent DataStore configuration changes for unexpected HikariCP properties, especially connectionInitSql.
Restrict network exposure of the Nexus Repository management interface to trusted administrative networks.

Patch Information

Sonatype addressed the issue in Nexus Repository 3.95.0 by restricting the set of HikariCP properties that can be modified through the DataStore configuration API. Additional guidance is available in the Sonatype Support Article.

Workarounds

Migrate the Nexus datastore from the default H2 backend to an external database such as PostgreSQL, which does not expose the same in-process code execution surface as H2.
Remove the nx-datastores-update permission from all non-administrator roles until the upgrade is applied.
Place the Nexus management interface behind a reverse proxy that enforces IP allow-listing and additional authentication.

bash

# Example: identify roles that grant nx-datastores-update via the Nexus REST API
curl -u admin:admin -H 'Accept: application/json' \
  https://nexus.example.com/service/rest/v1/security/roles \
  | jq '.[] | select(.privileges[]? == "nx-datastores-update") | {id, name, privileges}'