CVE-2026-97712 Overview
CVE-2026-97712 is a privilege escalation vulnerability in Sonatype Nexus Repository 3. The flaw allows any user holding the role create or role update permission to assign roles and privileges beyond those held by their own account. An attacker with a low-privilege administrative role can escalate up to full administrative access to the repository manager.
The vulnerability is classified under CWE-862: Missing Authorization. It affects authenticated users with network access to the Nexus Repository management interface or API.
Critical Impact
Users with limited role management permissions can grant themselves or others roles containing privileges they do not possess, including full administrator access to Nexus Repository 3.
Affected Products
- Sonatype Nexus Repository 3 (versions prior to 3.97.0)
- Deployments where non-administrator accounts hold the nx-roles-create or nx-roles-update privileges
- Both Nexus Repository OSS and Pro editions on affected release lines
Discovery Timeline
- 2026-10-15 - CVE-2026-97712 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-97712
Vulnerability Analysis
Sonatype Nexus Repository 3 uses a role-based access control (RBAC) model where privileges are grouped into roles that administrators assign to users. The role management interface exposes operations to create and update roles, each gated by a dedicated permission.
The vulnerability stems from the absence of a check that confirms the caller already holds every privilege they attempt to place into a role. A user with role create or role update permission can therefore construct a role containing arbitrary privileges and assign it to themselves or another account. This converts a narrowly scoped delegation of role management into a path to full administrative control.
The flaw is a Broken Access Control issue, specifically Vertical Privilege Escalation. Because the attacker already needs valid credentials with role management permissions, the attack is authenticated but requires no user interaction from an administrator.
Root Cause
The root cause is Missing Authorization on the role mutation endpoints. The server validates that the caller may create or update roles but does not validate that each privilege being written into the role is held by the caller. See the Sonatype support article for vendor confirmation.
Attack Vector
Exploitation requires network access to the Nexus Repository API and an authenticated session with the nx-roles-create or nx-roles-update privilege. The attacker invokes the role management REST endpoint with a payload that includes high-value privileges such as nx-all. The attacker then assigns the modified or newly created role to their account and reauthenticates with elevated access.
No exploit code or public proof of concept is referenced in the available advisories. Technical details are documented in the Sonatype Nexus Repository 3.97.0 release notes.
Detection Methods for CVE-2026-97712
Indicators of Compromise
- Audit log entries showing role created or role updated events where the resulting role contains privileges the acting user did not previously hold.
- New or modified roles containing high-impact privileges such as nx-all, nx-repository-admin-*, or nx-userschangepw.
- User accounts whose assigned roles changed shortly after a role management API call from the same session.
Detection Strategies
- Enable and centralize Nexus Repository audit logging for the security.role and security.user domains, then alert on privilege additions.
- Baseline each non-administrator account's role management activity and flag deviations, especially creation of roles containing administrative privileges.
- Correlate HTTP requests to /service/rest/v1/security/roles with the authenticated user's existing privilege set to identify over-privileged role writes.
Monitoring Recommendations
- Forward Nexus Repository audit and request logs to a SIEM for retention and correlation with authentication events.
- Monitor for unexpected logins by newly privileged accounts from unusual source addresses following role changes.
- Review the output of /service/rest/v1/security/roles on a schedule and diff against a known-good baseline.
How to Mitigate CVE-2026-97712
Immediate Actions Required
- Upgrade Sonatype Nexus Repository 3 to version 3.97.0 or later as documented in the 3.97.0 release notes.
- Audit all accounts holding the nx-roles-create or nx-roles-update privilege and remove the privilege where not strictly required.
- Review every role in the system for unauthorized privilege additions and revoke suspicious role assignments.
- Rotate credentials and API tokens for any account that may have been used to escalate privileges.
Patch Information
Sonatype addressed the issue in Nexus Repository 3.97.0. Administrators should consult the vendor support article for upgrade guidance and verification steps. No workaround substitutes for applying the patch.
Workarounds
- Restrict the nx-roles-create and nx-roles-update privileges to fully trusted administrators until the upgrade is complete.
- Place the Nexus Repository management interface behind network controls that limit access to administrative subnets.
- Enforce multi-factor authentication at the identity provider for any account with role management privileges.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
