Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: Sonatype Nexus Repository 3 CE/Pro versions 3.16.0 through 3.94.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N = 6.3 (Medium)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17596
Summary
Nexus Repository 3 is vulnerable to stored cross-site scripting (XSS). A user holding the nexus:blobstores:create or nexus:blobstores:update permission can set a blob store name containing malicious script content. That name is later rendered without proper output encoding in system health-check status messages, causing the injected script to execute in the browser of another user who views that status. This can allow an attacker to perform actions in the context of a higher-privileged user session, such as an administrator.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Immediate Mitigation Options
Restrict the nexus:blobstores:create and nexus:blobstores:update permissions to trusted administrators only, and avoid viewing system health-check status while untrusted blob store names may be present, until the upgrade can be applied.
Credit
This issue was discovered and reported responsibly by Yousif (s3c_krd) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker who can create or update a blob store can inject a script that executes in the browser session of another user (such as an administrator) who later views the system health-check status. This could be used to perform unauthorized actions or access information in the context of that user’s session.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must hold the nexus:blobstores:create or nexus:blobstores:update permission, which grants the ability to create or rename blob stores. A separate victim user must then view the system health-check status page while the malicious blob store name is present.
Q: Are there implications associated with this advisory itself?
A: As with any vulnerability disclosure, publishing details could help a malicious actor construct an exploit. We encourage all users to assess their exposure and apply the recommended upgrade or mitigations promptly.
Q: Why is Sonatype making this information available?
A: Sonatype is committed to responsible disclosure and proactively notifies users of security issues so they can take appropriate action to protect their systems.