Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: All previous Sonatype Nexus Repository 3 CE/Pro versions from 3.15.0 up to and including 3.94.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N = 5.3 (Medium)
CWE: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17595
Summary
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could craft a Content Selector expression that read Java object properties which were not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This does not permit method invocation or object construction, limiting the impact to information disclosure. This issue has been fixed by restricting property access in the JEXL sandbox to the intended data types.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Credit
This issue was discovered and reported responsibly by Hamza Khaled (hamza0x01) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An account with permission to create Content Selectors could construct an expression that discloses JVM class metadata (such as class names and classloader information) for objects used internally during expression evaluation. This does not allow method invocation, object construction, or arbitrary code execution.
Q: What preconditions must be met in order to be vulnerable?
A: An account must hold the nexus:selectors:create permission, which is granted to the Administrator role by default and can be delegated to other roles.
Q: Are there implications associated with this advisory itself?
A: As with any security advisory, publishing these details could help a bad actor construct an attack against unpatched instances. We recommend assessing your exposure and upgrading as soon as possible.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process, working with the reporter to validate and remediate the issue prior to public disclosure, and proactively notifying customers so they can take appropriate action.