Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: All previous Sonatype Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N = 8.2 (High)
CWE: CWE-863: Incorrect Authorization
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17594
Summary
Nexus Repository 3 contained an incorrect authorization vulnerability in its repository-creation user interface. An account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format by submitting a crafted request, because the server validated one request field for authorization while using a different, attacker-controlled field to determine which repository format to actually create. This precondition requires an individual user account holding a repository-admin privilege for at least one repository format.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Immediate Mitigation Options
Customers who cannot upgrade immediately should review and restrict repository-admin privilege grants (format-scoped add privileges in particular) to the minimum set of trusted accounts required, since exploitation requires holding at least one such privilege.
Credit
This issue was discovered and reported responsibly by Mayur Udiniya aka “roughwire” https://x.com/roughwire/ via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker who holds a repository-admin privilege scoped to one repository format could create a repository of a different format that they are not authorized to administer, exceeding their intended access.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must hold a valid account with at least one format-scoped repository-admin add privilege (e.g., granted administrative control over “maven2” repositories). This is a specific delegated administrative privilege, not mere authentication - a regular individual user account without this privilege cannot exploit the issue, and the anonymous user cannot hold this privilege by default.
Q: Are there implications associated with this advisory itself?
A: As with any vulnerability disclosure, publishing details could help a bad actor craft an exploit. We encourage all customers to assess their exposure and upgrade or apply mitigations promptly.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies customers of vulnerabilities affecting our products so they can take appropriate action.